aptly

aptly copied to clipboard

add an option to only allow adding of files via a .changes file.

Detailed Description

currently it is possible to directly add .deb-files to a repo via the API.

however i would like to disallow this, and only allow the user to add (via the API) files that have been properly packaged and come with a (possibly signed) .changes file.

i believe that together with #963, this would allow a more secure upload mechanism that relies on signed packages rather than http-auth via a proxy.

Context

mostly i would like to allow uploading of packages autogenerated on a CI to my private apt repository. i don't really trust http-auth for such a task and would like to be able (additionally?) secure the upload by a mechanism, that is already tried and tested for uploads to "Debian proper".

It is important for us, too.