Signing repository and packages in debian-repo

[j-rivero]

Describe the feature

Whole working on zenoh support for the Gazebo simulator project in gazebo-tooling/gzdev#94, we found that the .deb packages repository at https://download.eclipse.org/justj/?file=zenoh/debian-repo is not signed and needs to be used with [trusted=yes] . It would highly improve the security of the consumers of that repository.

It would be possible to sign the .deb packages in that repository or it is not supported from that Eclipse site?

[diogomatsubara]

Hi @j-rivero , thanks for the report. You're right, the debian packages should be signed. I'll follow up with the Eclipse Foundation about which secrets should we use to sign those artifacts and make the necessary changes in the build/publication workflow to include the signature.

[j-rivero]

Thanks @diogomatsubara . Let us know if you need any help that can provide.

[diogomatsubara]

@j-rivero the debian repository for zenoh is now signed. Could you give it a try? The instructions will be published soon but here is what you need:

Add Eclipse Zenoh public key to apt keyring

$ curl -L https://download.eclipse.org/zenoh/debian-repo/zenoh-public-key | sudo gpg --dearmor --yes --output /etc/apt/keyrings/zenoh-public-key.gpg

Add Eclipse Zenoh private repository to the sources list:

$ echo "deb [signed-by=/etc/apt/keyrings/zenoh-public-key.gpg] https://download.eclipse.org/zenoh/debian-repo/ /" | sudo tee -a /etc/apt/sources.list > /dev/null
$ sudo apt update