🆕 [Debian/Ubuntu users] Feedback on new package feed

[shiftkey]

I'm looking to migrate away from PackageCloud for many reasons, and after a bunch of false starts I have a new server setup with the necessary keys and bits that this should work as-is:

https://apt.packages.shiftkey.dev/

Relevant steps:

• install the GPG key associated with the signing key

wget -qO - https://apt.packages.shiftkey.dev/gpg.key | gpg --dearmor | sudo tee /etc/apt/keyrings/shiftkey-packages.asc > /dev/null

• add the package feed to apt

sudo sh -c 'echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/shiftkey-packages.gpg] https://apt.packages.shiftkey.dev/ubuntu/ any main" > /etc/apt/sources.list.d/shiftkey-packages-desktop.list'

• Refresh the feed

sudo apt update

If you have a previous version of github-desktop installed, you should be able to upgrade to the latest release from earlier this week, otherwise you can manually install the latest version 3.1.7-linux1:

sudo apt install github-desktop

Before I update the docs to point everyone to this I figure I'd open this up to anyone who wants to test it out and ensure I haven't missed any details...

[mwt]

Cool. I have a script that I've been using for a while over here:

https://github.com/mwt/desktop-makerepo

The script scans the github releases and adds new apt/rpm to the repos. There might be something useful in there that you can use (particularly the steps after scanning releases for rpm).

Edit: The repo works for me.

[jfgordon2]

Tested successfully on Ubuntu 22.04 - looking great 👍

[mwt]

I should set the origin of my mirror to these two new feeds so that packages are updated. If I do this, I think existing users will get a gpg error because they key likely changed. I think this is fine.

I could get around this by setting the new repo in a different path (i.e. not /ghd/) and put a more descriptive error on the old path that sends people to an issue that explains the transition. This is probably the smart way.

[mwt]

I set up a mirror from the new origins here:
https://mirror.mwt.me/shiftkey-desktop/

It seems to be working. There are two options:

1. Move /shiftkey-desktop/ -> /ghd/. Users will get a GPG error and come to the repo where they will see updated instructions.
2. Update readme to /shiftkey-desktop/ and put a descriptive error on /ghd/ so that users understand that they have to transition.

I think 2 will result in fewer issues being filed here.

[phanect]

@shiftkey Thanks for creating the official deb repository!

Unfortunately, it didn't work as expected on my end.
I use KDE neon, an Ubuntu variant. I think it should not so different from Ubuntu.

I installed the GPG key and repository info as written in the README.

wget -qO - https://apt.packages.shiftkey.dev/gpg.key | gpg --dearmor | sudo tee /etc/apt/keyrings/shiftkey-packages.asc > /dev/null
sudo sh -c 'echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/shiftkey-packages.asc] https://apt.packages.shiftkey.dev/ubuntu/ any main" > /etc/apt/sources.list.d/shiftkey-packages.list'

Then I ran sudo apt update, but GPG error was raised.

$ sudo apt update
Hit:1 http://download.virtualbox.org/virtualbox/debian jammy InRelease
Hit:2 https://dl.google.com/linux/chrome/deb stable InRelease                                                                                                                                                     
Hit:3 https://apt.releases.hashicorp.com jammy InRelease                                                                                                                                                          
Hit:4 http://packages.microsoft.com/repos/code stable InRelease                                                                                                                                                   
Hit:5 https://download.docker.com/linux/ubuntu jammy InRelease                                                                                                                                                    
Hit:6 https://deb.nodesource.com/node_18.x jammy InRelease                                                                                                                                                        
Get:7 http://security.ubuntu.com/ubuntu jammy-security InRelease [110 kB]                                                                                                                                         
Hit:8 http://archive.ubuntu.com/ubuntu jammy InRelease                                                                                                           
Get:9 https://apt.packages.shiftkey.dev/ubuntu any InRelease [1,226 B]                                                                                           
Err:9 https://apt.packages.shiftkey.dev/ubuntu any InRelease                                                                                                                   
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7FC979028B1997C1
Get:10 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [119 kB]                                                                    
Hit:11 https://ppa.launchpadcontent.net/mozillateam/ppa/ubuntu jammy InRelease                                                                         
Get:12 http://archive.neon.kde.org/user jammy InRelease [178 kB]                                                                                       
Reading package lists... Done                                                                       
W: GPG error: https://apt.packages.shiftkey.dev/ubuntu any InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7FC979028B1997C1
E: The repository 'https://apt.packages.shiftkey.dev/ubuntu any InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
$
$ cat /etc/apt/sources.list.d/shiftkey-packages.list 
deb [arch=amd64 signed-by=/etc/apt/keyrings/shiftkey-packages.asc] https://apt.packages.shiftkey.dev/ubuntu/ any main
$ ls /etc/apt/keyrings/shiftkey-packages.asc
/etc/apt/keyrings/shiftkey-packages.asc

I found InRelease may have wrong Origin and Label: https://apt.packages.shiftkey.dev/ubuntu/dists/any/InRelease
In InRelease, Origin and Label's values are packages.shiftkey.online, while the actual hostname is apt.packages.shiftkey.dev.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Origin: packages.shiftkey.online
Label: packages.shiftkey.online
Codename: any
Date: Sun, 19 Feb 2023 20:32:57 UTC
Architectures: amd64
Components: main
Description: Package feed for GitHub Desktop on Linux packages
...

Can you check the configuration?
Thanks!

[mwt]

@phanect afaik origin and label shouldn't cause an error like that. For example, these always differ from the hostname of any mirror (such as the official Ubuntu mirrors) and there is no issue caused by this.

The InRelease has the right signature. Perhaps there is something wrong with your local copy of shiftkey-packages.asc? Try running:

gpg --show-keys /etc/apt/keyrings/shiftkey-packages.asc

The output should be something like:

pub   ed25519 2023-02-19 [SC] [expires: 2028-02-18]
      4E02A356A18314B00A481F067FC979028B1997C1
uid                      Brendan Forster <packages@brendanforster.com>
sub   cv25519 2023-02-19 [E] [expires: 2028-02-18]

If not, then the first command (wget -qO - https://apt.packages.shiftkey.dev/gpg.key | gpg --dearmor | sudo tee /etc/apt/keyrings/shiftkey-packages.asc > /dev/null) should be rerun.

[shiftkey]

@phanect that's a good point - I'll get that into an update when I generate the next release, but I don't think that's why you're seeing GPG errors with the feed. As @mwt mentioned, let's confirm the GPG key you have is which one we expect to have...

[phanect]

@mwt @shiftkey Thanks for your assistance.

I have run the command, and it shows the identical result as @mwt's output:

$ gpg --show-keys /etc/apt/keyrings/shiftkey-packages.asc
pub   ed25519 2023-02-19 [SC] [expires: 2028-02-18]
      4E02A356A18314B00A481F067FC979028B1997C1
uid                      Brendan Forster <packages@brendanforster.com>
sub   cv25519 2023-02-19 [E] [expires: 2028-02-18]

afaik origin and label shouldn't cause an error like that.

If I remember correctly, it caused an error when I was trying to create a deb repo.
Actually, I was working on creating a deb repo for github-desktop these two or three days. (I didn't know @shiftkey is working on creating the repo by himself 😂)
While I was working on it, I changed the hostname from deb.phanective.org to apt.phanective.org, but I forgot to change the Origin and Label, and it caused an error.

KDE neon uses PackageKit as a package manager frontend while it is based on apt and deb, so perhaps it might have more strict restrictions than Ubuntu.