fix: preserve apt signature verification #38

Merged
andres merged 8 commits from build/1-apt-signed-install into main 2026-08-31 16:05:04 +00:00

8 commits

Author SHA1 Message Date
codex-bot-andresmgsl
2efc76f23e fix: address apt install review round
All checks were successful
labels / labels (pull_request) Successful in 10s
ci / test (pull_request) Successful in 14s
2026-08-31 15:14:12 +00:00
codex-bot-andresmgsl
9cc9576116 fix: limit apt opt-in to known sqv failure
All checks were successful
labels / labels (pull_request) Successful in 12s
ci / test (pull_request) Successful in 17s
2026-08-31 10:57:32 +00:00
codex-bot-andresmgsl
a89eafaebc fix: require opt-in for unverified apt sources
All checks were successful
labels / labels (pull_request) Successful in 12s
ci / test (pull_request) Successful in 17s
2026-08-31 10:48:42 +00:00
claude-lead-andresmgsl
9f34641545 fix: stop attributing the sqv rejection to the key algorithm
All checks were successful
labels / labels (pull_request) Successful in 11s
ci / test (pull_request) Successful in 17s
Refs #1.

`scripts/install-apt.sh` explained the sqv rejection as a malformed MPI
encoding in an Ed25519 key. The registry does not serve one: at
`api/packages/heavy-duty/debian/repository.key`, `gpg --list-packets`
reports `algo 1` (RSA) with a 2048-bit `pkey[0]`. The explanation was
therefore wrong about the only part of itself that was checkable.

The comment now states the measurement and points at #1 for the cause,
rather than naming a mechanism nobody verified. This satisfies #1's
criterion that `git grep -in 25519` return no hits outside test fixtures,
which it now does.

Behaviour is unchanged: this commit edits a comment. The automatic
fallback this file still performs contradicts ruling B and is NOT fixed
here — that work is still owed on !38.
2026-08-31 10:39:02 +00:00
codex-bot-andresmgsl
769a3c8aba fix: read apt credentials through sudo
All checks were successful
labels / labels (pull_request) Successful in 9s
ci / test (pull_request) Successful in 13s
2026-08-30 11:40:41 +00:00
codex-bot-andresmgsl
c7971eefe0 docs: document authenticated apt installs
All checks were successful
labels / labels (pull_request) Successful in 9s
ci / test (pull_request) Successful in 13s
2026-08-30 11:35:08 +00:00
codex-bot-andresmgsl
a28b2ffd74 feat: support private apt registry credentials
All checks were successful
labels / labels (pull_request) Successful in 9s
ci / test (pull_request) Successful in 13s
2026-08-30 11:34:06 +00:00
codex-bot-andresmgsl
acb46d0707 fix: keep apt signature verification on transient failures
All checks were successful
labels / labels (pull_request) Successful in 9s
ci / test (pull_request) Successful in 14s
2026-08-30 11:31:24 +00:00