Initial release: self-hostable APT repository server and CLI
urapt is a self-hostable APT repository server with a companion CLI for pushing and managing Debian .deb packages. Server (urapt-server): - REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO) - .deb files stored content-addressed on disk, reference-counted for dedup - Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto) - APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand from the DB, cached in memory, signed with the server key - Full APT model: repositories -> distributions -> components -> architectures - Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads - First registrant becomes admin; repo-scoped permissions (read/write/read-write/admin) plus owner and server-admin roles - Multipart package push with control-field extraction, list/show/delete, pool serving, blob ref-count cleanup - Audit log CLI (urapt): - register/login/logout/whoami, token management - repo/distro/component/arch CRUD, member management - push/pull/ls/show/rm for packages - apt-config helper that emits apt setup commands (key, sources.list, auth.conf for private repos) Packaging & docs: - Dockerfile (multi-stage distroless), docker-compose.yml, sample config - README quick start, architecture overview, config reference, security notes - PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE - GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64) - Makefile release target producing static binaries + tarballs + checksums Tests cover the data-access layer, auth/permission checks, APT index generation, .deb parsing, GPG signing, the REST API, and the typed API client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing a real package.
This commit is contained in:
@@ -0,0 +1,214 @@
|
||||
// Package gpg provides server-managed OpenPGP signing: key generation,
|
||||
// armored export/import, clearsigning (for InRelease), and detached signing
|
||||
// (for Release.gpg). It uses the pure-Go ProtonMail/go-crypto library so the
|
||||
// server has no runtime dependency on the gpg binary.
|
||||
package gpg
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto"
|
||||
"fmt"
|
||||
"io"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/ProtonMail/go-crypto/openpgp"
|
||||
"github.com/ProtonMail/go-crypto/openpgp/armor"
|
||||
"github.com/ProtonMail/go-crypto/openpgp/clearsign"
|
||||
"github.com/ProtonMail/go-crypto/openpgp/packet"
|
||||
)
|
||||
|
||||
// Key wraps an OpenPGP entity together with metadata urapt uses.
|
||||
type Key struct {
|
||||
Entity *openpgp.Entity
|
||||
Fingerprint string
|
||||
UserID string
|
||||
}
|
||||
|
||||
// GenerateKey creates a new RSA signing key with the given user-id (in the form
|
||||
// "Name <email>" or a plain name) and key size in bits.
|
||||
func GenerateKey(userID string, bits int) (*Key, error) {
|
||||
if bits <= 0 {
|
||||
bits = 4096
|
||||
}
|
||||
name, email := splitUserID(userID)
|
||||
cfg := &packet.Config{
|
||||
RSABits: bits,
|
||||
DefaultHash: crypto.SHA256,
|
||||
V6Keys: false,
|
||||
}
|
||||
entity, err := openpgp.NewEntity(name, "", email, cfg)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("new entity: %w", err)
|
||||
}
|
||||
return &Key{
|
||||
Entity: entity,
|
||||
Fingerprint: fmt.Sprintf("%X", entity.PrimaryKey.Fingerprint),
|
||||
UserID: userID,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// ParseArmoredPrivate decodes an ASCII-armored private key produced by
|
||||
// ArmoredPrivate.
|
||||
func ParseArmoredPrivate(armored string) (*Key, error) {
|
||||
block, err := armor.Decode(strings.NewReader(armored))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("decode armor: %w", err)
|
||||
}
|
||||
if block.Type != "PGP PRIVATE KEY BLOCK" {
|
||||
return nil, fmt.Errorf("unexpected armor type %q", block.Type)
|
||||
}
|
||||
entity, err := openpgp.ReadEntity(packet.NewReader(block.Body))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("read entity: %w", err)
|
||||
}
|
||||
uid := ""
|
||||
if id := entity.PrimaryIdentity(); id != nil {
|
||||
uid = id.Name
|
||||
}
|
||||
return &Key{
|
||||
Entity: entity,
|
||||
Fingerprint: fmt.Sprintf("%X", entity.PrimaryKey.Fingerprint),
|
||||
UserID: uid,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// ArmoredPublic returns the ASCII-armored public key.
|
||||
func (k *Key) ArmoredPublic() (string, error) {
|
||||
var buf bytes.Buffer
|
||||
w, err := armor.Encode(&buf, "PGP PUBLIC KEY BLOCK", nil)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("armor encode: %w", err)
|
||||
}
|
||||
if err := k.Entity.Serialize(w); err != nil {
|
||||
_ = w.Close()
|
||||
return "", fmt.Errorf("serialize public: %w", err)
|
||||
}
|
||||
if err := w.Close(); err != nil {
|
||||
return "", fmt.Errorf("close armor: %w", err)
|
||||
}
|
||||
return buf.String(), nil
|
||||
}
|
||||
|
||||
// ArmoredPrivate returns the ASCII-armored private key (unencrypted).
|
||||
func (k *Key) ArmoredPrivate() (string, error) {
|
||||
var buf bytes.Buffer
|
||||
w, err := armor.Encode(&buf, "PGP PRIVATE KEY BLOCK", nil)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("armor encode: %w", err)
|
||||
}
|
||||
if err := k.Entity.SerializePrivate(w, nil); err != nil {
|
||||
_ = w.Close()
|
||||
return "", fmt.Errorf("serialize private: %w", err)
|
||||
}
|
||||
if err := w.Close(); err != nil {
|
||||
return "", fmt.Errorf("close armor: %w", err)
|
||||
}
|
||||
return buf.String(), nil
|
||||
}
|
||||
|
||||
// ClearSign produces a clearsigned message (used for the InRelease file).
|
||||
func (k *Key) ClearSign(data []byte) ([]byte, error) {
|
||||
sk, ok := k.Entity.SigningKey(time.Now())
|
||||
if !ok {
|
||||
return nil, fmt.Errorf("no signing key available")
|
||||
}
|
||||
var out bytes.Buffer
|
||||
cfg := &packet.Config{DefaultHash: crypto.SHA256}
|
||||
plaintext, err := clearsign.Encode(&out, sk.PrivateKey, cfg)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("clearsign encode: %w", err)
|
||||
}
|
||||
if _, err := plaintext.Write(data); err != nil {
|
||||
_ = plaintext.Close()
|
||||
return nil, fmt.Errorf("write clearsign: %w", err)
|
||||
}
|
||||
if err := plaintext.Close(); err != nil {
|
||||
return nil, fmt.Errorf("close clearsign: %w", err)
|
||||
}
|
||||
return out.Bytes(), nil
|
||||
}
|
||||
|
||||
// DetachedSign produces an ASCII-armored detached signature of data (used for
|
||||
// Release.gpg).
|
||||
func (k *Key) DetachedSign(data []byte) ([]byte, error) {
|
||||
var out bytes.Buffer
|
||||
cfg := &packet.Config{DefaultHash: crypto.SHA256}
|
||||
if err := openpgp.ArmoredDetachSign(&out, k.Entity, bytes.NewReader(data), cfg); err != nil {
|
||||
return nil, fmt.Errorf("detach sign: %w", err)
|
||||
}
|
||||
return out.Bytes(), nil
|
||||
}
|
||||
|
||||
// VerifyClearSign is a test helper that verifies a clearsigned block and
|
||||
// returns the plaintext.
|
||||
func VerifyClearSign(armoredPublic string, clearsigned []byte) (plaintext []byte, err error) {
|
||||
key, err := ParseArmoredPublic(armoredPublic)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
block, rest := clearsign.Decode(clearsigned)
|
||||
if block == nil {
|
||||
return nil, fmt.Errorf("no clearsign block (rest=%d bytes)", len(rest))
|
||||
}
|
||||
keyring := openpgp.EntityList{key.Entity}
|
||||
if _, err := block.VerifySignature(keyring, nil); err != nil {
|
||||
return nil, fmt.Errorf("verify: %w", err)
|
||||
}
|
||||
return block.Bytes, nil
|
||||
}
|
||||
|
||||
// VerifyDetached verifies an armored detached signature of data using the
|
||||
// given armored public key. Test helper.
|
||||
func VerifyDetached(armoredPublic string, data, armoredSig []byte) error {
|
||||
key, err := ParseArmoredPublic(armoredPublic)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
keyring := openpgp.EntityList{key.Entity}
|
||||
if _, err := openpgp.CheckArmoredDetachedSignature(keyring, bytes.NewReader(data), bytes.NewReader(armoredSig), nil); err != nil {
|
||||
return fmt.Errorf("verify: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ParseArmoredPublic decodes an ASCII-armored public key.
|
||||
func ParseArmoredPublic(armored string) (*Key, error) {
|
||||
block, err := armor.Decode(strings.NewReader(armored))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("decode armor: %w", err)
|
||||
}
|
||||
if block.Type != "PGP PUBLIC KEY BLOCK" {
|
||||
return nil, fmt.Errorf("unexpected armor type %q", block.Type)
|
||||
}
|
||||
entity, err := openpgp.ReadEntity(packet.NewReader(block.Body))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("read entity: %w", err)
|
||||
}
|
||||
uid := ""
|
||||
if id := entity.PrimaryIdentity(); id != nil {
|
||||
uid = id.Name
|
||||
}
|
||||
return &Key{
|
||||
Entity: entity,
|
||||
Fingerprint: fmt.Sprintf("%X", entity.PrimaryKey.Fingerprint),
|
||||
UserID: uid,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// splitUserID parses a user-id of the form "Name <email>" into name and email.
|
||||
// If no email brackets are present, the whole string is treated as the name.
|
||||
func splitUserID(userID string) (name, email string) {
|
||||
userID = strings.TrimSpace(userID)
|
||||
i := strings.LastIndexByte(userID, '<')
|
||||
j := strings.LastIndexByte(userID, '>')
|
||||
if i >= 0 && j > i {
|
||||
name = strings.TrimSpace(userID[:i])
|
||||
email = strings.TrimSpace(userID[i+1 : j])
|
||||
return name, email
|
||||
}
|
||||
return userID, ""
|
||||
}
|
||||
|
||||
// ensure io is referenced (used implicitly by armor/clearsign APIs).
|
||||
var _ = io.EOF
|
||||
@@ -0,0 +1,68 @@
|
||||
package gpg
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestGenerateAndSign(t *testing.T) {
|
||||
k, err := GenerateKey("urapt-server <test.example.com>", 2048)
|
||||
if err != nil {
|
||||
t.Fatalf("GenerateKey: %v", err)
|
||||
}
|
||||
if k.Fingerprint == "" {
|
||||
t.Fatal("empty fingerprint")
|
||||
}
|
||||
|
||||
pub, err := k.ArmoredPublic()
|
||||
if err != nil {
|
||||
t.Fatalf("ArmoredPublic: %v", err)
|
||||
}
|
||||
if !bytes.Contains([]byte(pub), []byte("BEGIN PGP PUBLIC KEY BLOCK")) {
|
||||
t.Fatal("bad armored public")
|
||||
}
|
||||
priv, err := k.ArmoredPrivate()
|
||||
if err != nil {
|
||||
t.Fatalf("ArmoredPrivate: %v", err)
|
||||
}
|
||||
if !bytes.Contains([]byte(priv), []byte("BEGIN PGP PRIVATE KEY BLOCK")) {
|
||||
t.Fatal("bad armored private")
|
||||
}
|
||||
|
||||
data := []byte("Origin: urapt\nSuite: stable\n\nContents here.\n")
|
||||
|
||||
clear, err := k.ClearSign(data)
|
||||
if err != nil {
|
||||
t.Fatalf("ClearSign: %v", err)
|
||||
}
|
||||
if !bytes.Contains(clear, []byte("BEGIN PGP SIGNED MESSAGE")) {
|
||||
t.Fatal("bad clearsign output")
|
||||
}
|
||||
pt, err := VerifyClearSign(pub, clear)
|
||||
if err != nil {
|
||||
t.Fatalf("VerifyClearSign: %v", err)
|
||||
}
|
||||
if strings.ReplaceAll(string(pt), "\r\n", "\n") != string(data) {
|
||||
t.Fatalf("plaintext mismatch: got %q want %q", pt, data)
|
||||
}
|
||||
|
||||
det, err := k.DetachedSign(data)
|
||||
if err != nil {
|
||||
t.Fatalf("DetachedSign: %v", err)
|
||||
}
|
||||
if !bytes.Contains(det, []byte("BEGIN PGP SIGNATURE")) {
|
||||
t.Fatal("bad detached output")
|
||||
}
|
||||
if err := VerifyDetached(pub, data, det); err != nil {
|
||||
t.Fatalf("VerifyDetached: %v", err)
|
||||
}
|
||||
|
||||
k2, err := ParseArmoredPrivate(priv)
|
||||
if err != nil {
|
||||
t.Fatalf("ParseArmoredPrivate: %v", err)
|
||||
}
|
||||
if k2.Fingerprint != k.Fingerprint {
|
||||
t.Fatalf("fingerprint mismatch after round-trip: %s != %s", k2.Fingerprint, k.Fingerprint)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user