Debian package + APT repository

July 17, 2026 · View on GitHub

Ships Downloader as a .deb and hosts a signed APT repo on GitHub Pages so Debian/Ubuntu users can apt install downloader and get updates through apt upgrade.

A bare apt install downloader on a stock machine (no repo added) would need the package to be in the official Debian/Ubuntu archive, which requires maintainer sponsorship — out of scope. The one-time add-repo step below is the achievable path.

For users

curl -fsSL https://bezzad.github.io/Downloader.Desktop/apt/pubkey.gpg \
  | sudo gpg --dearmor -o /usr/share/keyrings/downloader.gpg
echo "deb [signed-by=/usr/share/keyrings/downloader.gpg] https://bezzad.github.io/Downloader.Desktop/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/downloader.list
sudo apt update && sudo apt install downloader

Or, without adding the repo, grab the .deb from a release and sudo apt install ./Downloader_*_amd64.deb.

How it's built

  • scripts/build-deb.sh builds dist/Downloader_<ver>_amd64.deb from a linux-x64 self-contained publish (app under /opt/downloader, /usr/bin/downloader symlink, .desktop entry + hicolor icon).
  • scripts/build-apt-repo.sh <out> <deb>... produces the signed repo (dists/stable/{Release,InRelease,Release.gpg}
    • pool/…). Needs only dpkg-scanpackages + gpg.
  • The deb job in .github/workflows/release.yml runs both on every v* tag, attaches the .deb to the release, and deploys the repo to Pages.

Signing key

  • Public key: packaging/apt/pubkey.gpg (committed; served at the repo root and under /apt/pubkey.gpg).
  • Key id: see packaging/apt/KEYID.
  • Private key: not in the repo. It must be added as the APT_GPG_PRIVATE_KEY repository secret (the full armored -----BEGIN PGP PRIVATE KEY BLOCK-----). Without it, the deb job still builds and attaches the .deb but skips the (unsignable) Pages repo deploy.

One-time author setup

  1. Settings → Pages → Source = "GitHub Actions".
  2. Settings → Secrets and variables → Actions → New secret APT_GPG_PRIVATE_KEY = the armored private key (generated alongside pubkey.gpg; stored out-of-repo when the key was created).
  3. Push a v* tag — the deb job publishes the repo. Verify the URLs above resolve.

To rotate the key: regenerate, replace pubkey.gpg + KEYID, update the secret.