What it is for. apt.secubox.in is the signed Debian repository that boxes update from. This page explains how it is laid out, how a package gets in, why a version must always go up, and how the signing key is unlocked.

Client sources line:

curl -fsSL https://apt.secubox.in/install.sh | sudo bash
sudo apt install secubox-lite      # or secubox-isp, secubox-full

The script installs the keyring and adds deb [signed-by=/usr/share/keyrings/secubox.gpg] https://apt.secubox.in trixie main. See Profils for what each profile installs and Trixie for the base-system change.

scripts/apt-publier.sh publishes one or several .deb files in one command:

scripts/apt-publier.sh [--force] secubox-exemple_1.2.3-1~trixie1_all.deb

What it does, in order:

1. Refuses a version lower than or equal to the one already in the repository (unless --force). A refused package makes the exit code non-zero even if the others were published, because it usually reveals a divergence between a branch and the deployed code.
2. Never publishes a preview (~aurora in the version): the automatic updater would install it overnight on every box.
3. Checks that the signing key can sign. When the key lives in the Coffre (the vault), it opens a 10-minute signing session; if the Coffre is sealed it stops before touching the repository.
4. Backs up db, dists and conf, then runs reprepro ... includedeb <suite> *.deb.
5. Runs an explicit reprepro export: an includedeb that fails on one package updates the database but does not re-export, so InRelease would stay old.
6. Verifies that InRelease is signed by the expected repository key.

The CI path (publish-packages.yml) does the same with reprepro -b repo includedeb <suite> <deb> for every artifact of a release, then exports the keyring (binary .gpg and armored .asc) and install.sh.

Rule: modified and deployed source = bumped version. Never deploy a changed package under an unchanged version: the repository would keep the old file and the boxes would never see the fix. Patch for a fix, minor for a feature, major for a release.

Before building and deploying a package, compare the first line of its debian/changelog with the version in the repository:

reprepro -b <base> list trixie secubox-<module>

If the repository is higher, your branch is stale: rebase first.

The key is protected by a passphrase that must already be in the memory of gpg-agent (reprepro runs without a terminal; otherwise it fails with Pinentry: Inappropriate ioctl for device). The passphrase is a secret of the Coffre, never a file:

1. The Coffre is sealed at boot; an administrator login opens it.
2. secubox-depot-coffre.timer runs every minute coffrectl depot deverrouiller --depuis-coffre --si-ouvert: sealed Coffre, nothing; key already signing, nothing; otherwise the passphrase is read from the Coffre and handed to gpg-agent (one-year TTL).
3. After a reboot of the repository host, log in as administrator: within a minute signing works again for every suite.

Check the state:

coffrectl depot etat
systemctl list-timers secubox-depot-coffre.timer

If an export fails because the key is locked, restart the unlocking unit (systemctl restart secubox-depot-deverrouille.service) rather than setting the passphrase by hand: a hand-made preset overwrites the good value.

Time-limited signing sessions: coffrectl depot session --minutes N (N at most 60) then coffrectl depot fin.

Operations-Release-Process · Operations-Runbook · Profils · Trixie · Installation · Operations-APT-Repository-FR