[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Packages getting created without signature



iluvlinux wrote:
[snip]
> ie  $ dpkg-buildpackage -rfakeroot -k<KEY> -sgpg
[snip]

Complementing what Bart said: '-k<KEY>' and '-sgpg' are also not needed.
The '-k' is mostly only needed for sponsoring uploads. After a quick
read of the thread, it seems you intend on maintaining this package
yourself.
The '-sgpg' switch is also not necessary in this context. Read
dpkg-buildpackage's manpage to understand why.

> So is there any way that i can automate this stuff. ie the dpkg-buildpkg
> should not ask for passphrase every time i build a new package, it should
> take it from a file or some ENV variable.

This would be VERY unsafe.
You have to understand the basics of cryptography and - more importantly
- the REASON for cryptography in Debian to see that you have to keep
your GPG key very safe and that includes not storing your passphrase in
any easily accessible place.
This definition of "easily" is very debated, but certainly a config file
or an ENV variable don't pass any test.
Most people agree that your passphrase shouldn't be stored at all, if
possible, and instead you should just backup your key and your
revocation certificate in safe, offline places, in case of emergency.

Do some research on the topic. Wikipedia is your friend (even if it's
not always particularly right about everything). It might ease your life
if you intend on becoming a Debian Maintainer or Developer.

Cheers and good luck with the package!

-- 
Leo "costela" Antunes
[insert a witty retort here]

Attachment: signature.asc
Description: OpenPGP digital signature


Reply to: