documentation/docs/dev_guide/install_keyring.md

sidebar_position

sidebar_position
4

Install Keyrings

🔑 Installing and Packaging Your Own Keyring on Arch Linux

When creating custom repositories or maintaining your own set of signed packages, you may need to create and package your own GPG keyring for secure verification. This guide walks you through the process of creating, installing, and packaging a custom keyring for Arch Linux.

---

1️⃣ Generate Your GPG Key

First, create a GPG key to sign packages or repositories if you don’t already have one.

gpg --full-generate-key

• Select the type: RSA and RSA (default).
• Set the key size: 4096.
• Set expiration: 0 (no expiration) or specify a validity period.
• Provide your name, email, and a strong passphrase.

To verify your key:

gpg --list-keys

You’ll see something like:

pub   rsa4096 2023-12-05 [SC]
      A41886F639658CA1A5519426E1415F19F21171F2
uid           [ultimate] Eshan Roy <eshanized@example.com>
sub   rsa4096 2023-12-05 [E]

---

2️⃣ Export Your GPG Public Key

Export your public key so it can be included in the keyring:

gpg --export --armor "Eshan Roy" > eshanized.gpg

This will create an ASCII-armored file, eshanized.gpg, containing your public key.

---

3️⃣ Create a Keyring Directory

Create a directory structure for the keyring:

mkdir -p eshanized-keyring
cd eshanized-keyring

Place the exported public key in the directory:

cp ../eshanized.gpg .

---

4️⃣ Package the Keyring for Installation

A. Create a PKGBUILD

Arch packages use a PKGBUILD script for building. Create a PKGBUILD file in the eshanized-keyring directory:

nano PKGBUILD

Here’s an example PKGBUILD for your keyring:

pkgname=eshanized-keyring
pkgver=1.0
pkgrel=1
pkgdesc="GPG keyring for Eshan Roy's repository"
arch=('any')
url="https://example.com"
license=('GPL')
source=('eshanized.gpg')
sha256sums=('SKIP')  # Replace SKIP with the actual SHA-256 checksum if desired

package() {
  install -Dm644 "$srcdir/eshanized.gpg" "$pkgdir/usr/share/pacman/keyrings/eshanized.gpg"
  install -Dm644 "$srcdir/eshanized.gpg" "$pkgdir/usr/share/pacman/keyrings/eshanized-trusted.gpg"
}

B. Build the Package

Run the following command to build the package:

makepkg -si

• makepkg creates the package (.pkg.tar.zst) file.
• -si installs the package after building.

This will install your keyring to /usr/share/pacman/keyrings/.

---

5️⃣ Verify the Installed Keyring

After installing the keyring package, check the directory to ensure your keyring files are correctly placed:

ls /usr/share/pacman/keyrings/

You should see:

eshanized.gpg
eshanized-trusted.gpg

---

6️⃣ Use Your Keyring for Custom Repositories

If you're hosting your own repository, update the pacman.conf file to use your keyring:

sudo nano /etc/pacman.conf

Add your repository:

[eshanized-repo]
SigLevel = Required
Server = https://example.com/$arch

Your keyring will now be used to verify packages from your custom repository.

---

7️⃣ Testing Your Setup

1. Add a package to your repository:
   Sign your package using your private GPG key:

   gpg --detach-sign --armor your-package.pkg.tar.zst
   

   Place both the .pkg.tar.zst file and its .sig file in your repository.

2. Test the repository with pacman:

   sudo pacman -Syu
   sudo pacman -Ss your-package
   

   Ensure the signature is verified using your keyring.

---

✅ Tips and Best Practices

1. Key Security:
   Keep your private key safe and secure. Avoid placing it on shared servers.

2. Regular Updates:
   Update and repackage your keyring if you add new GPG keys.

3. Checksum Validation:
   Use tools like sha256sum to ensure your PKGBUILD file includes valid checksums.

4. Documentation:
   Document your keyring package details for users who may need to add your repository.

By following these steps, you'll have a fully functional custom keyring integrated into your Arch Linux setup. 🎉