Signing packages

[nocturn]

How does one sign packages (the way that the ones from Ubuntu are signed)?

I want to set up a custom repo with my own packages, but I would like to sign them (I have a seperate key for that).

[nocturn]

Is it correct that I should only sign Release (detach, armour) on my repo?

[az]

Well, AFAIK, all of the debian packaging scripts will sign the package you build if you have a key available. This will happen even if you just download the source for a package and build it on your own machine. Offhand, I do not know how to specify one particular key out of several. I am sure it is well documented in the debian helper scripts packages.

So, no, you do not only have to sign the relase file.

[nocturn]

Well, AFAIK, all of the debian packaging scripts will sign the package you build if you have a key available. This will happen even if you just download the source for a package and build it on your own machine. Offhand, I do not know how to specify one particular key out of several. I am sure it is well documented in the debian helper scripts packages.

So, no, you do not only have to sign the relase file.

The thing is that I'm creating custom packages, mainly for themes and meta packages.

I use dpkg-deb --build debian to build

[nocturn]

Hm, so far, it seems that signing Release to Release.gpg shows no 'NOT AUTHENTICATED' errors...

good