{"id":398619,"date":"2024-06-29T14:10:59","date_gmt":"2024-06-29T14:10:59","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=398619"},"modified":"-0001-11-30T00:00:00","modified_gmt":"2024-06-29T14:10:59","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=398619","title":{"rendered":"<span>Creating and using your own deb repository (not mirroring)<\/span>"},"content":{"rendered":"<div><!--[--><!--]--><\/div>\n<div id=\"post-content-body\">\n<div>\n<div class=\"article-formatted-body article-formatted-body article-formatted-body_version-2\">\n<div xmlns=\"http:\/\/www.w3.org\/1999\/xhtml\">\n<h2>Intro<\/h2>\n<p>Tested on the following configuration:<br \/>Server: ubuntu 20.04<br \/>Clients: ubuntu 16.04, 18.04, 20.04<\/p>\n<p>It doesn\u2019t require a lot of software to create it.<\/p>\n<ul>\n<li>\n<p>web server with directory listing ( I use lighttpd)<\/p>\n<\/li>\n<li>\n<p>packages: gpg(for signs), dpkg-dev<\/p>\n<\/li>\n<li>\n<p>rng-tools (highly recommended)<\/p>\n<\/li>\n<\/ul>\n<p>Repo URL:\u00a0<a href=\"http:\/\/192.168.56.48\/repo\/\" rel=\"noopener noreferrer nofollow\">http:\/\/192.168.56.48\/repo\/<\/a>\u00a0(it is preferable to use DNS)<br \/>Repo directory on the server : \/var\/www\/html\/repo\/<br \/>Deb-packages directory: \/var\/www\/html\/repo\/deb-packages<br \/>Repo generation script: \/usr\/bin\/update-repo.sh<\/p>\n<h3>Server preparation<\/h3>\n<p>Main steps:<\/p>\n<ul>\n<li>\n<p>web server installation<\/p>\n<\/li>\n<li>\n<p>gpg-key generation<\/p>\n<\/li>\n<li>\n<p>creating script for repo generation<\/p>\n<\/li>\n<li>\n<p>repo creation<\/p>\n<\/li>\n<\/ul>\n<h4>Gpg-key generation notes<\/h4>\n<p>GPG needs entropy for key generation. These operations can be very time-consuming, but they can be sped up with rng-tools packages. Use the next command for ubuntu:<\/p>\n<pre><code>sudo apt-get update sudo apt-get install -y rng-tools <\/code><\/pre>\n<h4>Web server configuration<\/h4>\n<p>Now you need to install lighttpd and enable dir-listing on it:<\/p>\n<pre><code># install package apt-get install lighttpd # enable directory listing echo 'server.dir-listing = \"enable\"' > \/etc\/lighttpd\/conf-enabled\/dir-listing.conf # start lighhttpd and enable autostrt systemctl restart lighttpd systemctl enable lighttpd # create dir for repo mkdir -p \/var\/www\/html\/repo\/deb-packages\/ <\/code><\/pre>\n<p>Now you should put your deb-packages in \/var\/www\/html\/repo\/deb-packages\/<\/p>\n<h3>GPG-keys<\/h3>\n<p>I will use self-signed keys, but you should use your company\u2019s PKI-infrastructure (if available). Check if you already have the keys:<\/p>\n<pre><code>root@repo:~# gpg --list-keys gpg: directory '\/root\/.gnupg' created gpg: keybox '\/root\/.gnupg\/pubring.kbx' created gpg: \/root\/.gnupg\/trustdb.gpg: trustdb created <\/code><\/pre>\n<p>Now you can see that there are no keys available. First, we\u2019ll create keys-generation script. You should use the proper values for your repo:<\/p>\n<pre><code>cat >~\/.gnupg\/aptRepo &lt;&lt;EOF %echo Generating a basic OpenPGP key Key-Type: RSA Key-Length: 3072 Subkey-Type: ELG-E Subkey-Length: 3072 Name-Real: apt tech user Name-Comment: without passphrase Name-Email: apt@email.non Expire-Date: 0 %echo done EOF <\/code><\/pre>\n<p>Now create the keys. This may take some time. Do not set a password for the keys since you\u2019ll need to enter it every time the repo is updated:<\/p>\n<pre><code>root@repo:~# gpg --batch --gen-key ~\/.gnupg\/aptRepo gpg: Generating a basic OpenPGP key gpg: done gpg: key 16B7C8484EC3AC5F marked as ultimately trusted gpg: directory '\/root\/.gnupg\/openpgp-revocs.d' created gpg: revocation certificate stored as '\/root\/.gnupg\/openpgp-revocs.d\/D538A3381F3D2FC89F34EFDD16B7C8484EC3AC5F.rev' <\/code><\/pre>\n<p>Check the keys availability:<\/p>\n<pre><code>root@repo:~# gpg --list-keys gpg: checking the trustdb gpg: marginals needed: 3  completes needed: 1  trust model: pgp gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u \/root\/.gnupg\/pubring.kbx pub   rsa3072 2021-02-07 [SCEA]       D538A3381F3D2FC89F34EFDD16B7C8484EC3AC5F uid           [ultimate] apt tech user (without passphrase) &lt;apt@email.non> sub   elg3072 2021-02-07 [E] <\/code><\/pre>\n<p>OK, now you need to export keys to the file:<\/p>\n<pre><code>gpg --export -a D538A3381F3D2FC89F34EFDD16B7C8484EC3AC5F > \/var\/www\/html\/repo\/boozlachuRepo.gpg It's time to write a repo-creation script. I used the following variables     \u2022 updatescript=\/usr\/bin\/update-repo.sh - path to this script     \u2022 repodir=\/var\/www\/html\/repo - path to the repo     \u2022 gpgKey=\"D538A3381F3D2FC89F34EFDD16B7C8484EC3AC5F\" - gpg-key ID <\/code><\/pre>\n<pre><code>updatescript=\/usr\/bin\/update-repo.sh cat &lt;&lt;'EOFSH' >${updatescript} #!\/bin\/sh  # working directory repodir=\/var\/www\/html\/repo\/ # GPG key gpgKey=\"D538A3381F3D2FC89F34EFDD16B7C8484EC3AC5F\" cd ${repodir} # create the package index dpkg-scanpackages -m . > Packages cat Packages | gzip -9c > Packages.gz # create the Release file PKGS=$(wc -c Packages) PKGS_GZ=$(wc -c Packages.gz) cat &lt;&lt;EOF > Release Architectures: all Date: $(date -R -u) MD5Sum:  $(md5sum Packages  | cut -d\" \" -f1) $PKGS  $(md5sum Packages.gz  | cut -d\" \" -f1) $PKGS_GZ SHA1:  $(sha1sum Packages  | cut -d\" \" -f1) $PKGS  $(sha1sum Packages.gz  | cut -d\" \" -f1) $PKGS_GZ SHA256:  $(sha256sum Packages | cut -d\" \" -f1) $PKGS  $(sha256sum Packages.gz | cut -d\" \" -f1) $PKGS_GZ EOF gpg --yes -u $gpgKey --sign -bao Release.gpg Release EOFSH chmod 755 ${updatescript} <\/code><\/pre>\n<p>Don&#8217;t forget to install the dpkg-scanpackages util:<\/p>\n<pre><code>apt-get install dpkg-dev <\/code><\/pre>\n<h4>Repo creation\/update<\/h4>\n<p>Required steps for creation\/update:<\/p>\n<ul>\n<li>\n<p>add your deb-packages to \/var\/www\/html\/repo\/deb-packages<\/p>\n<\/li>\n<li>\n<p>run the creation script \/usr\/bin\/update-repo.sh<\/p>\n<\/li>\n<\/ul>\n<p>Script output example (for a single package):<\/p>\n<pre><code>\/usr\/bin\/update-repo.sh dpkg-scanpackages: info: Wrote 1 entries to output Packages file. <\/code><\/pre>\n<h3>Clients setup<\/h3>\n<p>First, add your repo to the apt source lists:<\/p>\n<pre><code>wget -O -  http:\/\/192.168.56.48\/repo\/boozlachuRepo.gpg | sudo apt-key add - echo 'deb http:\/\/192.168.56.48\/repo\/ .\/ ' >  \/etc\/apt\/sources.list.d\/boozlachuRepo.list apt-get update <\/code><\/pre>\n<p>You can now use this repo on clients:<\/p>\n<pre><code>root@alexey-VirtualBox:~# apt-cache search testpackage testpackage - simple testpackage for demo <\/code><\/pre>\n<p>My test package is now available for installation.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<p><!----><!----><\/div>\n<p><!----><!----><br \/> \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 <a href=\"https:\/\/habr.com\/ru\/articles\/543854\/\"> https:\/\/habr.com\/ru\/articles\/543854\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<div><!--[--><!--]--><\/div>\n<div id=\"post-content-body\">\n<div>\n<div class=\"article-formatted-body article-formatted-body article-formatted-body_version-2\">\n<div xmlns=\"http:\/\/www.w3.org\/1999\/xhtml\">\n<h2>Intro<\/h2>\n<p>Tested on the following configuration:<br \/>Server: ubuntu 20.04<br \/>Clients: ubuntu 16.04, 18.04, 20.04<\/p>\n<p>It doesn\u2019t require a lot of software to create it.<\/p>\n<ul>\n<li>\n<p>web server with directory listing ( I use lighttpd)<\/p>\n<\/li>\n<li>\n<p>packages: gpg(for signs), dpkg-dev<\/p>\n<\/li>\n<li>\n<p>rng-tools (highly recommended)<\/p>\n<\/li>\n<\/ul>\n<p>Repo URL:\u00a0<a href=\"http:\/\/192.168.56.48\/repo\/\" rel=\"noopener noreferrer nofollow\">http:\/\/192.168.56.48\/repo\/<\/a>\u00a0(it is preferable to use DNS)<br \/>Repo directory on the server : \/var\/www\/html\/repo\/<br \/>Deb-packages directory: \/var\/www\/html\/repo\/deb-packages<br \/>Repo generation script: \/usr\/bin\/update-repo.sh<\/p>\n<h3>Server preparation<\/h3>\n<p>Main steps:<\/p>\n<ul>\n<li>\n<p>web server installation<\/p>\n<\/li>\n<li>\n<p>gpg-key generation<\/p>\n<\/li>\n<li>\n<p>creating script for repo generation<\/p>\n<\/li>\n<li>\n<p>repo creation<\/p>\n<\/li>\n<\/ul>\n<h4>Gpg-key generation notes<\/h4>\n<p>GPG needs entropy for key generation. These operations can be very time-consuming, but they can be sped up with rng-tools packages. Use the next command for ubuntu:<\/p>\n<pre><code>sudo apt-get update sudo apt-get install -y rng-tools <\/code><\/pre>\n<h4>Web server configuration<\/h4>\n<p>Now you need to install lighttpd and enable dir-listing on it:<\/p>\n<pre><code># install package apt-get install lighttpd # enable directory listing echo 'server.dir-listing = \"enable\"' > \/etc\/lighttpd\/conf-enabled\/dir-listing.conf # start lighhttpd and enable autostrt systemctl restart lighttpd systemctl enable lighttpd # create dir for repo mkdir -p \/var\/www\/html\/repo\/deb-packages\/ <\/code><\/pre>\n<p>Now you should put your deb-packages in \/var\/www\/html\/repo\/deb-packages\/<\/p>\n<h3>GPG-keys<\/h3>\n<p>I will use self-signed keys, but you should use your company\u2019s PKI-infrastructure (if available). Check if you already have the keys:<\/p>\n<pre><code>root@repo:~# gpg --list-keys gpg: directory '\/root\/.gnupg' created gpg: keybox '\/root\/.gnupg\/pubring.kbx' created gpg: \/root\/.gnupg\/trustdb.gpg: trustdb created <\/code><\/pre>\n<p>Now you can see that there are no keys available. First, we\u2019ll create keys-generation script. You should use the proper values for your repo:<\/p>\n<pre><code>cat >~\/.gnupg\/aptRepo &lt;&lt;EOF %echo Generating a basic OpenPGP key Key-Type: RSA Key-Length: 3072 Subkey-Type: ELG-E Subkey-Length: 3072 Name-Real: apt tech user Name-Comment: without passphrase Name-Email: apt@email.non Expire-Date: 0 %echo done EOF <\/code><\/pre>\n<p>Now create the keys. This may take some time. Do not set a password for the keys since you\u2019ll need to enter it every time the repo is updated:<\/p>\n<pre><code>root@repo:~# gpg --batch --gen-key ~\/.gnupg\/aptRepo gpg: Generating a basic OpenPGP key gpg: done gpg: key 16B7C8484EC3AC5F marked as ultimately trusted gpg: directory '\/root\/.gnupg\/openpgp-revocs.d' created gpg: revocation certificate stored as '\/root\/.gnupg\/openpgp-revocs.d\/D538A3381F3D2FC89F34EFDD16B7C8484EC3AC5F.rev' <\/code><\/pre>\n<p>Check the keys availability:<\/p>\n<pre><code>root@repo:~# gpg --list-keys gpg: checking the trustdb gpg: marginals needed: 3  completes needed: 1  trust model: pgp gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u \/root\/.gnupg\/pubring.kbx pub   rsa3072 2021-02-07 [SCEA]       D538A3381F3D2FC89F34EFDD16B7C8484EC3AC5F uid           [ultimate] apt tech user (without passphrase) &lt;apt@email.non> sub   elg3072 2021-02-07 [E] <\/code><\/pre>\n<p>OK, now you need to export keys to the file:<\/p>\n<pre><code>gpg --export -a D538A3381F3D2FC89F34EFDD16B7C8484EC3AC5F > \/var\/www\/html\/repo\/boozlachuRepo.gpg It's time to write a repo-creation script. I used the following variables     \u2022 updatescript=\/usr\/bin\/update-repo.sh - path to this script     \u2022 repodir=\/var\/www\/html\/repo - path to the repo     \u2022 gpgKey=\"D538A3381F3D2FC89F34EFDD16B7C8484EC3AC5F\" - gpg-key ID <\/code><\/pre>\n<pre><code>updatescript=\/usr\/bin\/update-repo.sh cat &lt;&lt;'EOFSH' >${updatescript} #!\/bin\/sh  # working directory repodir=\/var\/www\/html\/repo\/ # GPG key gpgKey=\"D538A3381F3D2FC89F34EFDD16B7C8484EC3AC5F\" cd ${repodir} # create the package index dpkg-scanpackages -m . > Packages cat Packages | gzip -9c > Packages.gz # create the Release file PKGS=$(wc -c Packages) PKGS_GZ=$(wc -c Packages.gz) cat &lt;&lt;EOF > Release Architectures: all Date: $(date -R -u) MD5Sum:  $(md5sum Packages  | cut -d\" \" -f1) $PKGS  $(md5sum Packages.gz  | cut -d\" \" -f1) $PKGS_GZ SHA1:  $(sha1sum Packages  | cut -d\" \" -f1) $PKGS  $(sha1sum Packages.gz  | cut -d\" \" -f1) $PKGS_GZ SHA256:  $(sha256sum Packages | cut -d\" \" -f1) $PKGS  $(sha256sum Packages.gz | cut -d\" \" -f1) $PKGS_GZ EOF gpg --yes -u $gpgKey --sign -bao Release.gpg Release EOFSH chmod 755 ${updatescript} <\/code><\/pre>\n<p>Don&#8217;t forget to install the dpkg-scanpackages util:<\/p>\n<pre><code>apt-get install dpkg-dev <\/code><\/pre>\n<h4>Repo creation\/update<\/h4>\n<p>Required steps for creation\/update:<\/p>\n<ul>\n<li>\n<p>add your deb-packages to \/var\/www\/html\/repo\/deb-packages<\/p>\n<\/li>\n<li>\n<p>run the creation script \/usr\/bin\/update-repo.sh<\/p>\n<\/li>\n<\/ul>\n<p>Script output example (for a single package):<\/p>\n<pre><code>\/usr\/bin\/update-repo.sh dpkg-scanpackages: info: Wrote 1 entries to output Packages file. <\/code><\/pre>\n<h3>Clients setup<\/h3>\n<p>First, add your repo to the apt source lists:<\/p>\n<pre><code>wget -O -  http:\/\/192.168.56.48\/repo\/boozlachuRepo.gpg | sudo apt-key add - echo 'deb http:\/\/192.168.56.48\/repo\/ .\/ ' >  \/etc\/apt\/sources.list.d\/boozlachuRepo.list apt-get update <\/code><\/pre>\n<p>You can now use this repo on clients:<\/p>\n<pre><code>root@alexey-VirtualBox:~# apt-cache search testpackage testpackage - simple testpackage for demo <\/code><\/pre>\n<p>My test package is now available for installation.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<p><!----><!----><\/div>\n<p><!----><!----><br \/> \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 <a href=\"https:\/\/habr.com\/ru\/articles\/543854\/\"> https:\/\/habr.com\/ru\/articles\/543854\/<\/a><br \/><\/br><\/br><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-398619","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/398619","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=398619"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/398619\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=398619"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=398619"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=398619"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}