Skip to content

Conversation

@oxpa
Copy link

@oxpa oxpa commented May 26, 2025

I'm using relic to sign a bunch of linux packages. Deb, rpm, apk and (not quite linux:) freebsd pkg.
The two latter use openssl dgst or a wrapper for it
Here are sources for APK: https://github.com/alpinelinux/abuild/blob/292a03128e6c08dae5194f0794fe0d55450171ff/abuild-sign.in#L35
And here is a man page that describes BSD approach to signing repos: pkg-repo

The process is roughly the same: one needs an rsa key and pksc1v1.5 signature. Not quite sure if I'm correct in this naming but Crypto.Signer does exactly what's needed.

The implementation is quite straightforward: just get the key and sign. There is no filetype associated with the signer. Nor there is a way to verify the signature: if I get it right - currently there is no way to pass specific key to use for verification. But openssl pkeyutl does that for me.

Let me know if there is anything I can improve in this code.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant