feat: --apply adds the Keel security suite to security.sources #9

Merged

navigator merged 1 commit from feat/keel-security-suite into main

2026-10-15 18:44:55 -03:00

navigator commented

2026-10-15 18:19:50 -03:00

Owner

--apply writes the Keel security suite into security.sources, after the Debian stanza, the same way as common writes it into an image (common#52):

Types: deb
URIs: https://archive.keellinux.org
Suites: trixie-security
Components: main
Signed-By: /usr/share/keyrings/keel-security-keyring.gpg

The daily cron-apt reads security.sources alone (handbook decision 0055, "Why a security suite"). After a transition it now installs the fixes to Keel packages the same way as Debian's.

debian/control: depends on keel-archive-keyring (>= 0.3.0), the first version that installs the security keyring. Without it, the Signed-By file is missing and the daily apt update of cron-apt fails. 0.3.0 is in trixie and trixie-security.
The plan line of security.sources names both stanzas. --rollback removes the file as before.
Version 0.2.2, README and man page.

Tests: written first, in tests/turnkey19.bats: the stanza, and the index targets that apt reads from security.sources alone.

`--apply` writes the Keel security suite into `security.sources`, after the Debian stanza, the same way as common writes it into an image (common#52): ``` Types: deb URIs: https://archive.keellinux.org Suites: trixie-security Components: main Signed-By: /usr/share/keyrings/keel-security-keyring.gpg ``` The daily cron-apt reads `security.sources` alone (handbook decision 0055, "Why a security suite"). After a transition it now installs the fixes to Keel packages the same way as Debian's. - `debian/control`: depends on `keel-archive-keyring (>= 0.3.0)`, the first version that installs the security keyring. Without it, the `Signed-By` file is missing and the daily `apt update` of cron-apt fails. 0.3.0 is in trixie and trixie-security. - The plan line of `security.sources` names both stanzas. `--rollback` removes the file as before. - Version 0.2.2, README and man page. Tests: written first, in `tests/turnkey19.bats`: the stanza, and the index targets that apt reads from `security.sources` alone.

navigator added 1 commit

2026-10-15 18:19:50 -03:00

feat: --apply adds the Keel security suite to security.sources

security / security (pull_request) Successful in 1m16s

Details

tests / package (pull_request) Successful in 4s

Details

tests / tests (pull_request) Successful in 1m31s

Details

8f7e18f0a8

security.sources gets a second stanza after Debian's: trixie-security of
archive.keellinux.org, with Signed-By keel-security-keyring.gpg (handbook
decision 0055). The daily cron-apt reads that file alone, so after a
transition it installs the fixes to Keel packages too. The package now
depends on keel-archive-keyring (>= 0.3.0), which installs the keyring.