Skip to main content

# Install Keyrings

### 🔑 Installing and Packaging Your Own Keyring on Arch Linux​

When creating custom repositories or maintaining your own set of signed packages, you may need to create and package your own GPG keyring for secure verification. This guide walks you through the process of creating, installing, and packaging a custom keyring for Arch Linux.

### 1️⃣ Generate Your GPG Key​

First, create a GPG key to sign packages or repositories if you don’t already have one.

    gpg --full-generate-key

- Select the type: `RSA and RSA (default)`.
- Set the key size: `4096`.
- Set expiration: `0` (no expiration) or specify a validity period.
- Provide your name, email, and a strong passphrase.

To verify your key:

    gpg --list-keys

You’ll see something like:

    pub   rsa4096 2023-12-05 [SC]
          A41886F639658CA1A5519426E1415F19F21171F2
    uid           [ultimate] Eshan Roy <eshanized@example.com>
    sub   rsa4096 2023-12-05 [E]

### 2️⃣ Export Your GPG Public Key​

Export your public key so it can be included in the keyring:

    gpg --export --armor "Eshan Roy" > eshanized.gpg

This will create an ASCII-armored file, `eshanized.gpg`, containing your public key.

### 3️⃣ Create a Keyring Directory​

Create a directory structure for the keyring:

    mkdir -p eshanized-keyring
    cd eshanized-keyring

Place the exported public key in the directory:

    cp ../eshanized.gpg .

### 4️⃣ Package the Keyring for Installation​

#### A. Create a PKGBUILD​

Arch packages use a `PKGBUILD` script for building. Create a `PKGBUILD` file in the `eshanized-keyring` directory:

    nano PKGBUILD

Here’s an example `PKGBUILD` for your keyring:

    pkgname=eshanized-keyring
    pkgver=1.0
    pkgrel=1
    pkgdesc="GPG keyring for Eshan Roy's repository"
    arch=('any')
    url="https://example.com"
    license=('GPL')
    source=('eshanized.gpg')
    sha256sums=('SKIP')  # Replace SKIP with the actual SHA-256 checksum if desired

    package() {
      install -Dm644 "$srcdir/eshanized.gpg" "$pkgdir/usr/share/pacman/keyrings/eshanized.gpg"
      install -Dm644 "$srcdir/eshanized.gpg" "$pkgdir/usr/share/pacman/keyrings/eshanized-trusted.gpg"
    }

#### B. Build the Package​

Run the following command to build the package:

    makepkg -si

- `makepkg` creates the package (`.pkg.tar.zst`) file.
- `-si` installs the package after building.

This will install your keyring to `/usr/share/pacman/keyrings/`.

### 5️⃣ Verify the Installed Keyring​

After installing the keyring package, check the directory to ensure your keyring files are correctly placed:

    ls /usr/share/pacman/keyrings/

You should see:

    eshanized.gpg
    eshanized-trusted.gpg

### 6️⃣ Use Your Keyring for Custom Repositories​

If you're hosting your own repository, update the `pacman.conf` file to use your keyring:

    sudo nano /etc/pacman.conf

Add your repository:

    [eshanized-repo]
    SigLevel = Required
    Server = https://example.com/$arch

Your keyring will now be used to verify packages from your custom repository.

### 7️⃣ Testing Your Setup​

1. Add a package to your repository:
   Sign your package using your private GPG key:

       gpg --detach-sign --armor your-package.pkg.tar.zst

   Place both the `.pkg.tar.zst` file and its `.sig` file in your repository.

2. Test the repository with pacman:

       sudo pacman -Syu
       sudo pacman -Ss your-package

   Ensure the signature is verified using your keyring.

### ✅ Tips and Best Practices​

1. Key Security:
   Keep your private key safe and secure. Avoid placing it on shared servers.

2. Regular Updates:
   Update and repackage your keyring if you add new GPG keys.

3. Checksum Validation:
   Use tools like `sha256sum` to ensure your `PKGBUILD` file includes valid checksums.

4. Documentation:
   Document your keyring package details for users who may need to add your repository.

By following these steps, you'll have a fully functional custom keyring integrated into your Arch Linux setup. 🎉