Pinning and other fanciness aside, I just use this quick and dirty
bit of script to build my in-place repositories for me:
rm -f Contents.bz2 Contents.gz Packages.bz2 Packages.gz \
Release Release.gpg Sources.bz2 Sources.gz
apt-ftparchive contents . > Contents
bzip2 -k Contents
gzip -9 Contents
apt-ftparchive packages . > Packages
bzip2 -k Packages
gzip -9c Packages > Packages.gz
apt-ftparchive sources . > Sources
bzip2 -k Sources
gzip -9c Sources > Sources.gz
apt-ftparchive release . > Release
rm Packages Sources
gpg --armor --default-key ="Jeremy Stanley <[EMAIL PROTECTED]>" \
--detach-sign --output Release.gpg Release
This works to get signed releases in etch and later, and then users
of the repository can:
finger [EMAIL PROTECTED] | sudo apt-key add -
...or:
wget -O- \
"http://subkeys.pgp.net:11371/pks/lookup?op=get&search=0x29ABF7441FB84657"; \
| sudo apt-key add -
...at which point apt-get will stop complaining about unsigned
packages/releases for them.
--
{ IRL(Jeremy_Stanley); PGP(9E8DFF2E4F5995F8FEADDC5829ABF7441FB84657);
SMTP([EMAIL PROTECTED]); IRC([EMAIL PROTECTED]); ICQ(114362511);
AIM(dreadazathoth); YAHOO(crawlingchaoslabs); FINGER([EMAIL PROTECTED]);
MUD([EMAIL PROTECTED]:6669); WWW(http://fungi.yuggoth.org/); }
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
