Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Native package repositories

Besides the signed curl | sh channel (see ci/install.sh), keyboot’s userland tools are published as native packages on packages.osterman.co — an apk repo, an apt repo, and a Gentoo overlay. All three are built and signed in CI on a release tag (.gitlab-ci.yml: package:apk / package:deb / package:overlay → publish:repos), from the same artifacts as the raw channel.

Packages provided (the three-package split, ADR 0008):

PackageContents
keybootruntime tools: the static keyboot binary, keyboot-autosnap, keyboot-snap, keyboot-update-check, keyboot-keys, keyboot-be-upgrade, keyboot-be-rollback
keyboot-installthe rescue/install keyboot-install binary (never auto-pulled)
keyboot-bootthe keyboot kernel + initramfs (A/B-staged boot image)

Alpine (apk)

# Trust the repo signing key, then add the repo and install.
wget -O /etc/apk/keys/keyboot-pkg.rsa.pub https://packages.osterman.co/alpine/keyboot-pkg.rsa.pub
echo "https://packages.osterman.co/alpine/v3.23" >> /etc/apk/repositories
apk update
apk add keyboot                 # runtime tools
apk add keyboot-install         # + the installer (rescue hosts)

Debian / Ubuntu (apt)

# Trust the archive key (dearmored into the keyrings dir).
curl -fsSL https://packages.osterman.co/debian/keyboot-archive-keyring.asc \
  | gpg --dearmor -o /usr/share/keyrings/keyboot-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/keyboot-archive-keyring.gpg] https://packages.osterman.co/debian stable main" \
  > /etc/apt/sources.list.d/keyboot.list
apt-get update
apt-get install keyboot

The Debian repo ships only the keyboot package (the running-host userland — a fully static binary that runs on glibc). keyboot-install (FFI rescue binary) and keyboot-boot (kernel + initramfs) are Alpine/rescue-only; get them from the apk repo or the rescue image.

Gentoo (overlay)

The package host is static HTTP, so the overlay is distributed as a snapshot tarball you add as a local overlay (the ebuilds fetch the prebuilt musl statics from the package host, so there is nothing to compile):

The overlay tarball is published per release; use the current version (from https://packages.osterman.co/keyboot/latest):

ver=$(wget -qO- https://packages.osterman.co/keyboot/latest)   # e.g. v0.1.12
mkdir -p /var/db/repos/keyboot
wget -O - "https://packages.osterman.co/gentoo-overlay/keyboot-overlay-${ver#v}.tar.gz" \
  | tar -xz -C /var/db/repos/keyboot --strip-components=1
cat > /etc/portage/repos.conf/keyboot.conf <<'EOF'
[keyboot]
location = /var/db/repos/keyboot
masters = gentoo
auto-sync = no
EOF
emerge -av app-admin/keyboot
emerge -av app-admin/keyboot-install

Signing

  • apk: the repository APKINDEX.tar.gz is abuild-signed with the keyboot apk RSA key; its public half is /alpine/keyboot-pkg.rsa.pub.
  • apt: Release is GPG-signed (InRelease + Release.gpg) with the keyboot apt key; public half /debian/keyboot-archive-keyring.asc.
  • gentoo: thin-manifest DIST entries carry per-distfile BLAKE2B + SHA512; the distfiles themselves are the raw channel artifacts (which are minisign-covered by the release SHA256SUMS).

The signing keys live as Protected CI variables (APK_SIGN_PRIVKEY, APT_GPG_KEY); back them up offline like the minisign key.