Files
aptly/system/t06_publish
Tim Foerster d616977904 Add SOURCE_DATE_EPOCH support for GPG signers
Both the external GPG signer (--faked-system-time) and internal Go
OpenPGP signer (signerConfig.Time) now honor SOURCE_DATE_EPOCH,
producing reproducible signatures alongside the plain Release file dates.

Adds system tests for both signer backends verifying byte-identical
Release, Release.gpg and InRelease across repeated publishes.

The signer tests (PublishRepo3[78]Test) are using an ed25519 key because
ed25519 signatures are deterministic by design. The Go openpgp library
uses a random nonce for DSA/ECDSA (see signature.go Sign calls using
config.Random() link below) so those signatures vary across runs
even with a fixed timestamp, making byte-identical verification impossible.

In addition to 49f342878a
Ref: https://github.com/aptly-dev/aptly/pull/1537
Ref: https://github.com/ProtonMail/go-crypto/blob/v1.4.0/openpgp/packet/signature.go#L945-L979
2026-04-26 14:32:23 +02:00
..
2024-07-31 22:16:00 +02:00
2024-07-24 21:19:47 +02:00
2014-04-16 00:22:11 +04:00
2015-04-05 22:47:19 +03:00
2017-04-26 23:17:03 +03:00
2017-07-28 22:37:20 +03:00
2019-09-06 23:42:56 +03:00
2024-10-22 16:58:15 +02:00
2024-10-22 16:58:15 +02:00
2024-10-22 16:58:15 +02:00
2024-10-22 16:58:15 +02:00
2024-11-01 20:01:45 +01:00
2024-10-22 16:58:15 +02:00
2024-10-22 16:58:15 +02:00
2026-01-16 14:50:09 +01:00
2025-04-25 00:51:59 +02:00
2017-04-26 23:17:04 +03:00
2024-10-22 16:58:15 +02:00
2017-04-26 23:17:04 +03:00
2026-03-03 07:38:44 +00:00
2026-03-03 07:38:44 +00:00