Debian

Relic generates a Debian repository's indexes from its packages, with each distribution's Release signed by the repository's key pair.

Upload a package to any folder of a local repository:

relic artifact upload hello_2.10-3_amd64.deb debian-local/pool/main/h/hello/hello_2.10-3_amd64.deb

Place it in a distribution (deb.component defaults to main, deb.architecture to the package's). Each property takes several values, and the package is listed in each distribution and component they name:

relic artifact props set debian-local/pool/main/h/hello/hello_2.10-3_amd64.deb deb.distribution=bookworm deb.component=main

As root, this command writes the APT source, your token in /etc/apt/auth.conf.d/ and the repository's public key (--components names components other than main):

relic package setup apt debian --distribution bookworm --write

For a remote, the source has no signed-by, so apt checks the upstream's indexes with the keys it already trusts, such as Debian's.

Update apt:

apt-get update

Install a package:

apt-get install hello

To configure apt by hand, save the public key, served on the JFrog® Artifactory® API:

curl -fsSL -u <you>:<token> -o /etc/apt/keyrings/relic.asc https://relic.example.com/artifactory/api/security/keypair/public/repositories/debian

Add the source to /etc/apt/sources.list.d/relic.list:

deb [signed-by=/etc/apt/keyrings/relic.asc] https://relic.example.com/debian/debian bookworm main

Add your credentials to /etc/apt/auth.conf.d/relic.conf, readable by root only:

machine relic.example.com login <you> password <token>

A virtual repository merges its members' indexes and signs the result. From remote members it takes only the architectures listed (default amd64 and arm64):

apiVersion: relic.build/v1
kind: Repository
metadata:
  name: debian
spec:
  class: virtual
  format: debian
  architectures: [amd64]
  signingKey: debian-signing
  virtual:
    members: [debian-local, debian-remote]
    deployTo: debian-local

• A package for all is listed under every architecture.
• A remote, such as https://deb.debian.org/debian, serves the upstream's signed indexes unchanged; apt checks them with the upstream's key.
• signingKey names the OpenPGP key pair that signs a local or virtual repository's indexes, created on first use. The default is relic-gpg. secondarySigningKey also signs, so the key can be replaced: apt accepts indexes signed by both with either key, and relic package setup apt run again puts both public keys in the client's keyring (Signing keys).
• Date in Release moves forward whenever the distribution's indexes change, deletions included, so apt takes the new indexes.
• A virtual repository's indexes are rebuilt at most every 30 seconds. A request after that gets the last built copy while one rebuild runs, and waits for the rebuild when the copy is older than 10 minutes.
• Through the JFrog Artifactory API, debianArchitectures is architectures, primaryKeyPairRef the signing key and secondaryKeyPairRef the secondary signing key. jf rt upload --deb bookworm/main/amd64 sets the three properties.