Kalysto APT DEB packages repository

Signed APT repository for the kal-shlib-* shell libraries and kal-scripts.

Signing key

All repository metadata is signed with:

1D64 73F8 11FA AFDB 3A85 FD0E F7C6 EF9A 4B98 5918

Valentin Lab (DEB repository signing key) <valentin.lab@kalysto.org> — RSA 3072, created 2021-03-11.

The key is published in two interchangeable encodings:

/conf/kalysto.org-archive-keyring.gpg — binary (use with a .gpg filename)
/conf/public-key.asc — ASCII-armored (use with a .asc filename)

The filename extension must match the encoding. APT selects its parser from the extension: .gpg means binary, .asc means ASCII-armored. Armored bytes stored under a .gpg name are silently ignored by APT 2.x, which then reports NO_PUBKEY.

Add the repository (Debian 12+, Ubuntu 22.04+)

## Install the signing key
sudo curl -fsSL -o /etc/apt/keyrings/kalysto.org-archive-keyring.gpg \
     https://deb.kalysto.org/conf/kalysto.org-archive-keyring.gpg

## Declare the repository (deb822 format)
sudo tee /etc/apt/sources.list.d/kalysto.org.sources >/dev/null <<'EOF'
Types: deb
URIs: https://deb.kalysto.org
Suites: no-dist
Components: kal-alpha kal-beta kal-main
Signed-By: /etc/apt/keyrings/kalysto.org-archive-keyring.gpg
EOF

sudo apt-get update

This repository is flat-suite: the suite is literally named no-dist and does not track a Debian or Ubuntu release. The same packages serve every distribution.

One-line format (older systems)

If you must use the legacy .list format, the signed-by option is still mandatory:

deb [signed-by=/etc/apt/keyrings/kalysto.org-archive-keyring.gpg] \
    https://deb.kalysto.org no-dist kal-alpha kal-beta kal-main

Components

kal-alpha — current packages
kal-beta — pre-release packages
kal-main — stable channel (currently empty)

Do not use apt-key. It is deprecated since Debian 11 and is no longer shipped in Debian 13 (trixie), which also stopped trusting the global /etc/apt/trusted.gpg keyring. Keys added the old way are invisible to APT 3.x and the repository is then rejected with Missing key … which is needed to verify signature. Use Signed-By: as shown above.