ubuntu-appstore-developers team mailing list archive

[Michael Vogt <mvo@xxxxxxxxxx>]

On Mon, Aug 18, 2014 at 05:32:44PM -0300, Martin Albisetti wrote:
> On Mon, Aug 18, 2014 at 3:56 PM, Michael Vogt <mvo@xxxxxxxxxx> wrote:
> > Help appreciated to get the right pubkey for production :)
> 
> *looks down in shame for not checking*
> That is the staging key.
> 
> Here is the production key: http://paste.ubuntu.com/8082832/

Thanks! This key works fine.

The client side of the signature support is ready in landing silo 006
and works well for me in my testing on the phone and on the desktop.
It has not landed yet because we are in TRAINCON-0 though. The
required new packages debsig-verify and click-ubuntu-policy are seeded
too.

Once this has landed you will have to pass "--allow-unauthenticated"
to click in order to install unsigned packages (like your local test
clicks :). Something like:

# click install --user=phablet --allow-unauthenticated foo_1.0.click

should work. Click will refuse to install any unsigned clicks by
default now.

Cheers,
 Michael

P.S. Iirc the server team asked for support in debsig-verify to place
policy/keyring in other directories than /etc, /usr/share - this is
now possible with the --root option in debsig-verify git.