Publish dfetch to an APT repository (apt install dfetch on Ubuntu/Debian)

[spoorcc]

Goal

Make dfetch installable via apt on Ubuntu and Debian by hosting a signed APT repository on GitHub Pages and keeping it updated automatically on each release.

Background

dfetch already builds a self-contained .deb via Nuitka + fpm in CI (build.yml). The missing piece is a signed APT repository that apt can consume. Hosting it on GitHub Pages avoids external dependencies and keeps everything within the dfetch-org GitHub organisation.

Users would install with:

curl -fsSL https://dfetch-org.github.io/apt/dfetch.gpg | sudo tee /usr/share/keyrings/dfetch.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/dfetch.gpg] https://dfetch-org.github.io/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/dfetch.list
sudo apt update
sudo apt install dfetch

Suggested plan

1. Create a dfetch-org/apt repository

Create a new GitHub repository dfetch-org/apt with GitHub Pages enabled on the main branch. This repo holds the APT repository structure managed by reprepro.

Alternatively, a dedicated gh-pages branch in the existing dfetch repo works, but a separate repo keeps release artifacts isolated.

2. Generate a GPG signing key

gpg --batch --gen-key <<EOF
Key-Type: RSA
Key-Length: 4096
Name-Real: dfetch APT repo
Name-Email: apt@dfetch.dev
Expire-Date: 0
%no-protection
EOF
gpg --export --armor apt@dfetch.dev > dfetch.gpg          # public key → commit to apt repo
gpg --export-secret-keys --armor apt@dfetch.dev           # private key → GitHub secret APT_GPG_KEY

Store the private key as APT_GPG_KEY and the key ID as APT_GPG_KEY_ID in a GitHub apt environment secret.

3. Add reprepro configuration

In the dfetch-org/apt repo, add:

conf/distributions:
  Origin: dfetch-org
  Label: dfetch
  Codename: stable
  Architectures: amd64
  Components: main
  Description: dfetch APT repository
  SignWith: <KEY_ID>

4. Add apt-publish.yml workflow

In the dfetch repo, trigger on release: [published]:

name: Publish to APT repo

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      release-tag:
        description: 'Release tag (e.g. 0.14.2)'
        required: true

jobs:
  publish:
    if: >-
      github.event_name != 'release' ||
      github.event.release.tag_name != 'latest'
    runs-on: ubuntu-latest
    environment:
      name: apt
      url: https://dfetch-org.github.io/apt

    steps:
      - name: Download .deb from release
        env:
          TAG: ${{ github.event.release.tag_name || inputs.release-tag }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release download "$TAG" \
            --repo dfetch-org/dfetch \
            --pattern '*.deb' \
            --dir dist/

      - name: Check out APT repo
        uses: actions/checkout@...
        with:
          repository: dfetch-org/apt
          token: ${{ secrets.APT_REPO_TOKEN }}
          path: apt-repo

      - name: Import GPG key & add package
        env:
          APT_GPG_KEY: ${{ secrets.APT_GPG_KEY }}
          APT_GPG_KEY_ID: ${{ secrets.APT_GPG_KEY_ID }}
        run: |
          echo "$APT_GPG_KEY" | gpg --import
          sudo apt-get install -y reprepro
          reprepro -b apt-repo includedeb stable dist/*.deb

      - name: Push updated APT repo
        run: |
          cd apt-repo
          git config user.name "dfetch-bot"
          git config user.email "bot@dfetch.dev"
          git add -A
          git commit -m "Add dfetch ${{ github.event.release.tag_name || inputs.release-tag }}"
          git push

5. Add a one-liner install script (optional but user-friendly)

Host https://dfetch-org.github.io/apt/install.sh:

#!/bin/sh
set -e
curl -fsSL https://dfetch-org.github.io/apt/dfetch.gpg \
  | sudo tee /usr/share/keyrings/dfetch.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/dfetch.gpg] https://dfetch-org.github.io/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/dfetch.list
sudo apt update
sudo apt install dfetch

6. Verify on a clean Ubuntu container

docker run --rm -it ubuntu:24.04 bash
# run the one-liner above
dfetch --version

Alternatives considered

Option	Pro	Con
GitHub Pages + reprepro (recommended)	Free, no external accounts, full control	Requires managing GPG key rotation
Launchpad PPA	Official Ubuntu integration, trusted by users	Requires source packages (not binary), Launchpad account, GPG upload process
Packagecloud / Cloudsmith	Hosts APT + YUM in one place	External service; free tier has storage/bandwidth limits

Acceptance criteria

• apt install dfetch works on Ubuntu 22.04 and 24.04 after adding the repo
• The APT repo is updated automatically on each GitHub Release
• Packages are GPG-signed and verified by apt
• The workflow is skipped for the rolling latest tag
• Public key and install instructions are documented in doc/how-to/