From 6158a3a693c9b0c28513076215e888702c68f746 Mon Sep 17 00:00:00 2001 From: William Mantly Date: Mon, 13 Jul 2026 18:12:44 -0400 Subject: [PATCH] install.sh: support Debian 13 (trixie) OpenResty repo (#121) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two issues on Debian 13 (Trixie): 1. apt's sequoia GPG backend now rejects SHA-1 signatures, and the OpenResty repo signing key is still SHA-1 — so `apt-get update` fails to verify the repo. When /usr/share/apt/default-sequoia.config is present (Debian 13+), install a back-end override that extends the SHA-1 acceptance window to 2028 (the OpenResty key is expected to rotate to a stronger algorithm; revisit before then). No-op on older Debian/Ubuntu. Idempotent on re-run. 2. The repo path was hardcoded to /package/ubuntu with the host codename, which worked on older Debian by coincidence. trixie lives under /package/debian, so pick the tree by distro ID (debian -> /package/debian, else -> /package/ubuntu). docs/installation.md: mirror both changes in the manual install steps, with a note that install.sh applies the sequoia override automatically. Co-authored-by: Claude --- docs/installation.md | 23 ++++++++++++++++++++++- ops/install.sh | 28 +++++++++++++++++++++++++++- 2 files changed, 49 insertions(+), 2 deletions(-) diff --git a/docs/installation.md b/docs/installation.md index b05f6b7..1673552 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -62,13 +62,34 @@ npm --version ### Step 3: Install OpenResty +openresty.org ships distinct trees for Debian and Ubuntu — use `/package/debian` +on Debian and `/package/ubuntu` on Ubuntu (using the Ubuntu tree with a Debian +codename worked on older Debian by coincidence; trixie lives under `/debian`). + ```bash +# Debian: OR_PATH=package/debian Ubuntu/Mint: OR_PATH=package/ubuntu +. /etc/os-release +case "$ID" in debian) OR_PATH=package/debian;; *) OR_PATH=package/ubuntu;; esac + wget -O - https://openresty.org/package/pubkey.gpg | \ sudo gpg --dearmor -o /usr/share/keyrings/openresty.gpg -echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/openresty.gpg] http://openresty.org/package/ubuntu $(lsb_release -sc) main" | \ +echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/openresty.gpg] http://openresty.org/${OR_PATH} $(lsb_release -sc) main" | \ sudo tee /etc/apt/sources.list.d/openresty.list +``` +> **Debian 13 (trixie):** apt's sequoia GPG backend rejects SHA-1 signatures by +> default, and the OpenResty signing key is still SHA-1, so `apt update` will +> refuse the repo. Extend the SHA-1 acceptance window before updating: +> ```bash +> sudo mkdir -p /etc/crypto-policies/back-ends +> sudo cp /usr/share/apt/default-sequoia.config /etc/crypto-policies/back-ends/apt-sequoia.config +> sudo sed -i 's/2026-02-01/2028-02-01/' /etc/crypto-policies/back-ends/apt-sequoia.config +> ``` +> (The `default-sequoia.config` file only ships on Debian 13+, so this is a no-op +> on older releases. `ops/install.sh` applies this automatically.) + +```bash apt update && apt install openresty -y ``` diff --git a/ops/install.sh b/ops/install.sh index ae6cf5f..2943eef 100755 --- a/ops/install.sh +++ b/ops/install.sh @@ -48,11 +48,37 @@ echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.co > /etc/apt/sources.list.d/nodesource.list echo "==> OpenResty apt source" +# openresty.org ships distinct trees for Debian vs Ubuntu; pick by distro ID. +# (Using the ubuntu tree with a Debian codename worked on older Debian by +# coincidence — trixie lives under /debian, so be explicit.) +. /etc/os-release 2>/dev/null || true +case "${ID:-}" in + debian) OR_REPO_PATH="package/debian" ;; + *) OR_REPO_PATH="package/ubuntu" ;; # ubuntu, mint, etc. +esac +install -d -m 0755 /usr/share/keyrings wget -qO- https://openresty.org/package/pubkey.gpg \ | gpg --dearmor --yes -o /usr/share/keyrings/openresty.gpg -echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/openresty.gpg] http://openresty.org/package/ubuntu $(lsb_release -sc) main" \ +echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/openresty.gpg] http://openresty.org/${OR_REPO_PATH} $(lsb_release -sc) main" \ > /etc/apt/sources.list.d/openresty.list +# Debian 13 (trixie) tightened apt's sequoia GPG backend to reject SHA-1 +# signatures, but the OpenResty repo signing key is still SHA-1 — so the next +# apt-get update would refuse the repo ("unsignable" / weak digest). Extend +# the SHA-1 acceptance window via a back-end override. The source config only +# ships on Debian 13+, so this is a no-op on older Debian / Ubuntu. Idempotent: +# re-runs re-copy the default and re-extend it. +if [ -f /usr/share/apt/default-sequoia.config ]; then + install -d -m 0755 /etc/crypto-policies/back-ends + cp -f /usr/share/apt/default-sequoia.config /etc/crypto-policies/back-ends/apt-sequoia.config + sed -i 's/2026-02-01/2028-02-01/' /etc/crypto-policies/back-ends/apt-sequoia.config + if grep -q '2028-02-01' /etc/crypto-policies/back-ends/apt-sequoia.config; then + echo " extended apt sequoia SHA-1 acceptance to 2028 (OpenResty key is SHA-1)" + else + echo " WARNING: sequoia override did not apply (config date string changed?) — apt update may reject the OpenResty repo" >&2 + fi +fi + echo "==> Install Node.js + OpenResty" apt-get update apt-get install -y nodejs openresty