theta42/proxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

install.sh: support Debian 13 (trixie) OpenResty repo (#121)

Browse Source 
Two issues on Debian 13 (Trixie):

1. apt's sequoia GPG backend now rejects SHA-1 signatures, and the OpenResty
   repo signing key is still SHA-1 — so `apt-get update` fails to verify the
   repo. When /usr/share/apt/default-sequoia.config is present (Debian 13+),
   install a back-end override that extends the SHA-1 acceptance window to
   2028 (the OpenResty key is expected to rotate to a stronger algorithm;
   revisit before then). No-op on older Debian/Ubuntu. Idempotent on re-run.

2. The repo path was hardcoded to /package/ubuntu with the host codename,
   which worked on older Debian by coincidence. trixie lives under
   /package/debian, so pick the tree by distro ID (debian -> /package/debian,
   else -> /package/ubuntu).

docs/installation.md: mirror both changes in the manual install steps, with a
note that install.sh applies the sequoia override automatically.

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
William Mantly
2026-07-13 18:12:44 -04:00
committed by GitHub
parent 8dcecbcfa2
commit 6158a3a693
2 changed files with 49 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/installation.md
+22 -1
View File
@@ -62,13 +62,34 @@ npm --version
### Step 3: Install OpenResty
openresty.org ships distinct trees for Debian and Ubuntu — use `/package/debian`
on Debian and `/package/ubuntu` on Ubuntu (using the Ubuntu tree with a Debian
codename worked on older Debian by coincidence; trixie lives under `/debian`).
```bash
# Debian: OR_PATH=package/debian Ubuntu/Mint: OR_PATH=package/ubuntu
. /etc/os-release
case "$ID" in debian) OR_PATH=package/debian;; *) OR_PATH=package/ubuntu;; esac
wget -O - https://openresty.org/package/pubkey.gpg | \
sudo gpg --dearmor -o /usr/share/keyrings/openresty.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/openresty.gpg] http://openresty.org/package/ubuntu $(lsb_release -sc) main" | \
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/openresty.gpg] http://openresty.org/${OR_PATH} $(lsb_release -sc) main" | \
sudo tee /etc/apt/sources.list.d/openresty.list
```
> **Debian 13 (trixie):** apt's sequoia GPG backend rejects SHA-1 signatures by
> default, and the OpenResty signing key is still SHA-1, so `apt update` will
> refuse the repo. Extend the SHA-1 acceptance window before updating:
> ```bash
> sudo mkdir -p /etc/crypto-policies/back-ends
> sudo cp /usr/share/apt/default-sequoia.config /etc/crypto-policies/back-ends/apt-sequoia.config
> sudo sed -i 's/2026-02-01/2028-02-01/' /etc/crypto-policies/back-ends/apt-sequoia.config
> ```
> (The `default-sequoia.config` file only ships on Debian 13+, so this is a no-op
> on older releases. `ops/install.sh` applies this automatically.)
```bash
apt update && apt install openresty -y
```
ops/install.sh
+27 -1
View File
@@ -48,11 +48,37 @@ echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.co
> /etc/apt/sources.list.d/nodesource.list
echo "==> OpenResty apt source"
# openresty.org ships distinct trees for Debian vs Ubuntu; pick by distro ID.
# (Using the ubuntu tree with a Debian codename worked on older Debian by
# coincidence — trixie lives under /debian, so be explicit.)
. /etc/os-release 2>/dev/null || true
case "${ID:-}" in
debian) OR_REPO_PATH="package/debian" ;;
*) OR_REPO_PATH="package/ubuntu" ;; # ubuntu, mint, etc.
esac
install -d -m 0755 /usr/share/keyrings
wget -qO- https://openresty.org/package/pubkey.gpg \
| gpg --dearmor --yes -o /usr/share/keyrings/openresty.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/openresty.gpg] http://openresty.org/package/ubuntu $(lsb_release -sc) main" \
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/openresty.gpg] http://openresty.org/${OR_REPO_PATH} $(lsb_release -sc) main" \
> /etc/apt/sources.list.d/openresty.list
# Debian 13 (trixie) tightened apt's sequoia GPG backend to reject SHA-1
# signatures, but the OpenResty repo signing key is still SHA-1 — so the next
# apt-get update would refuse the repo ("unsignable" / weak digest). Extend
# the SHA-1 acceptance window via a back-end override. The source config only
# ships on Debian 13+, so this is a no-op on older Debian / Ubuntu. Idempotent:
# re-runs re-copy the default and re-extend it.
if [ -f /usr/share/apt/default-sequoia.config ]; then
install -d -m 0755 /etc/crypto-policies/back-ends
cp -f /usr/share/apt/default-sequoia.config /etc/crypto-policies/back-ends/apt-sequoia.config
sed -i 's/2026-02-01/2028-02-01/' /etc/crypto-policies/back-ends/apt-sequoia.config
if grep -q '2028-02-01' /etc/crypto-policies/back-ends/apt-sequoia.config; then
echo " extended apt sequoia SHA-1 acceptance to 2028 (OpenResty key is SHA-1)"
else
echo " WARNING: sequoia override did not apply (config date string changed?) — apt update may reject the OpenResty repo" >&2
fi
fi
echo "==> Install Node.js + OpenResty"
apt-get update
apt-get install -y nodejs openresty