This is a heads up for our Debian users! As of today, we have updated our repository setup script and documentation to no longer rely on the recently deprecated apt-key binary.
The apt-key binary was previously used within the Cloudsmith setup script for Debian systems to install the repository GPG key to the system keyring. This method is no longer recommended and is deprecated from Debian Stretch and Ubuntu 22.04 onwards. Debian encourages user keyrings for repository signing keys, and we have taken note!
For most users, there should be no material impact. Existing repository installations will continue to function as usual. Users who leverage the generated script will notice that this now installs repository keys via the more secure and recommended approach. We have also tailored this to ensure that our users on legacy systems remain unaffected.
If, however you or your users leverage the config.deb.txt endpoint, please note that this now automatically includes the signed-by directive, expecting the GPG key to be installed to /usr/share/keyrings.
You can now use the following manual steps to install Debian repositories:
# For Debian Stretch, Ubuntu 16.04 and later
keyring_location=/usr/share/keyrings/<owner>-<repo>-archive-keyring.gpg
# For Debian Jessie, Ubuntu 15.10 and earlier
keyring_location=/etc/apt/trusted.gpg.d/<owner>-<repo>.gpg curl -1sLf 'https://dl.cloudsmith.io/public/<owner>/<repo>/gpg.<fingerprint>.key' | gpg --dearmor > curl -1sLf 'https://dl.cloudsmith.io/public/<owner>/<repo>/config.deb.txt?distro=<distro>&codename=<version>' > /etc/apt/sources.list.d/<owner>-<repo>.list
apt-get updateDebian Repository Documentation
Good news! We've added support for Cosign to the Cloudsmith OCI registry. Cosign is part of the open-source project sigstore, which makes it easy for developers to sign releases and for users to verify them. With this integration, Cloudsmith customers can sign OCI artifacts using Cosign, and push the generated signature into Cloudsmith to be store…
We're excited to announce that Cloudsmith now supports Conda packages. Conda is a cross-platform, language-agnostic binary package manager. It is the package manager used by Anaconda installations. Cloudsmith provides support for both public and private repositories for Conda. Cloudsmith's support for Conda is currently in Invitational Beta. If yo…
We're very pleased to announce that NuGet is the latest package format to support upstream caching and proxying. With upstream proxying, Cloudsmith will allow NuGet clients configured to use your repository to see and download your existing repository packages, as well as all those defined in any connected upstream repositories. When upstream cac…
We have always been big fans of Dart and what the Google Dart team has been trying to achieve. In fact, Cloudsmith was the first package management product to announce support for Dart packages in private repositories. With that in mind, we are happy to announce improvements to our Dart package support. Consulting with the Google Dart team on the…
Good news! We've improved the UI and APIs for user management within organizations. Added The people management UI now shows the email addresses of members (redaction configurable). The organization members API can now show unredacted emails (if configured). A new setting for showing unredacted emails was added to the "Global Privileges" org se…
When designing upstream support for Cloudsmith, we always strived to ensure that we could build an understanding of every package available on a remote repository. This information is beneficial, helping inform performance, analysis, and security decisions. With this in mind, we're happy to announce an essential improvement to upstream support for…
By submitting this form, you agree to our privacy policy
