Ubuntu – how do you create a “signed” deb package

debpackagingsignature

I want to create a number of deb packages, but I don't know how "signing" packages works. So I was wondering how to create a signed deb package.

Best Answer

Package signing on Ubuntu/Debian systems is rather messy. In theory, signing a deb package makes it possible for the person receiving your package to verify that the package was not modified after you signed it. In reality, signature verification is terribly difficult to setup and is disabled by default. Unless the user does a bunch of setup locally, they won't be verifying the signature when the package is installed.

In order to sign a package, you can use either: debsigs or dpkg-sig. The signatures are not compatible with one another, so you'll need to make sure the user is using the proper tool on the receiving side for verifying signatures.

dpkg-sig is easier to use for both you and the user, but debsigs is the tool with built-in support (which is disabled by default) on Ubuntu and Debian.

I wrote a blog post containing all the technical details of signing and verifying source packages (.dsc files), binary packages (.deb), and APT package repositories themselves here: http://blog.packagecloud.io/eng/2014/10/28/howto-gpg-sign-verify-deb-packages-apt-repositories/