Sign apt repository

[Steiniche]

As per #3349 and https://insomnia.rest/blog/new-insomnia-apt-repository the new repository at download.konghq.com provides the insomnia binaries for installation on ubuntu like distros.
However, currently we have to put trusted=yes as the repository is not signed.
It would be better to sign the repository such that apt can check if the repository can be trusted and not bypass current best practice security checks.

It would also be beneficial to change the install description found on https://insomnia.rest/blog/new-insomnia-apt-repository from using trusted=yes to allow-insecure=yes as this will warn the user with WARNING: The following packages cannot be authenticated! thus making it explicit that the package is from an insecure repository.

This issue has been created as I have not found another where this is tracked and as #3349 is closed there is likely no progress.

[kj4ezj]

Are there any updates on this?

It has been over two years since issue 3349 and issue 3508 have been opened. It is extremely irresponsible to direct consumers to set trusted=yes without explaining the implications of this. Other FOSS projects sign their PPAs, what specifically is preventing this PPA from being signed?

Thank you.

[kj4ezj]

Make that three years.

[ledroide]

FYI : in deb822 sources format, the right syntax to bypass error messages is :

Types: deb
URIs: https://download.konghq.com/insomnia-ubuntu/
Trusted: yes
Suites: default
Components: all

[subnetmarco]

@filfreire what are your thoughts here? I do agree that we should sign official distributions.

[filfreire]

@subnetmarco replied here: #3698 (comment)

[filfreire]

@Steiniche @kj4ezj please follow the latest instructions to setup APT installation of Insomnia

# Add to sources
curl -1sLf \
  'https://packages.konghq.com/public/insomnia/setup.deb.sh' \
  | sudo -E distro=ubuntu codename=focal bash


# Refresh repository sources and install Insomnia

sudo apt-get update
sudo apt-get install insomnia

You should no longer have to set trusted=yes or allow-insecure=yes. The installation script has some steps to set the proper GPG key.

See https://docs.insomnia.rest/insomnia/install

[kj4ezj]

Thank you very much!