Page 1 of 1

Synology Repo help

Posted: 18 Aug 2015, 13:26
by DKeppi
Hi rednoah,

some guys (including me) of the german synology forum are very interested to host our own Synology Repo with PGP Key for selfmade packages. We search the whole internet, but there are only code snipplets or minimalistic repos without key support.

So i want to ask you, if it is possible to tell us how your Synology Repo https://app.filebot.net/syno works?

I saw it is an index.json file with Package details and key inside, but there must be something in the background that the Packagemanager of the Synology accept it.

Could you help us?

THX a lot
DKeppi

Re: Synology Repo help

Posted: 18 Aug 2015, 23:57
by rednoah
Sure, took me quite a while to figure it out myself... there goes many days! :D


I only ever got it working after I got the source code for CodeSign.php from Synology:
https://forum.synology.com/enu/viewtopi ... 23&t=98760

Here's test script that does everything: create keys, use keys to sign package
https://forum.synology.com/enu/viewtopi ... 60#p379237

By following the code you will also understand how the signing works. How to create your own public key, how to create a signature, how to have the signature signed, etc

Adding your public key to your repository is the easiest part. Just add a "keyrings" array, and DSM will import the key as trusted key when you add the repo. There's no magic here. The magic is all in how packages are signed.


PS:
I've made an ant task that allows me to easily build/sign spk files and generate repository json files. It might come in handy for whatever you're doing:
https://github.com/rednoah/ant-spk

There's an example that should work right out of the box. You don't really need to understand how the signing works exactly. ;)