Highlights: Repository Management

Key highlights

• A Debian repository is a collection of files and directories of a certain structure. Often, several repositories share the same package files in a pool/ directory.

• Software for managing Debian repositories exists in several flavors based on the use cases and workflows. They all need a GPG key for signing a repository and typically third-party software like an HTTP server for making the repository available remotely.

• The aptly repository manager works with repositories from which we create immutable snapshots that we can then merge, filter, and publish.

• The trust in the integrity of Debian repositories is secured by a chain of cryptographic signatures. It starts with people asserting the ownership of a key to a person and their legal name. The Debian Developer can then sign a source package, which is uploaded to a build server, and from there to a repository, which again uses cryptography to ensure the integrity of a repository.