Hacker News Reader

> packaging and publishing debs is often going to be a lot more work

Creating a baseline .deb file takes at most 10 minutes if you know what you're doing. To know what you're doing, you need to spend ~2 hours once.

It's not rocket science (finding the documentation is tbh). :)

View on HN

What about rpm? And then signing it? What's the benefit here?

When you set your CI/CD pipeline, creating packages, signing them and updating your repositories are all trivial tasks (been there, done that).

In this case, explicitly telling "this is my repository and this is the public key. gnupg the key, add this repository line, and get the packages" provides an end to end verified package pipeline. No .sh scripts to compromise.

If you keep your private keys on a network detached place and only plug your keys while signing stuff, things are pretty secure out of the box.

RPM is much simpler than deb: .spec is just single file with metadata, build recipe, and list of files. Example:

https://src.fedoraproject.org/rpms/5minute/blob/rawhide/f/5m...

Signing of packages is used to protect from malware.

Reply on news.ycombinator.com