Packaging Suggestion - Debian based distros

Add the following to the postinst file to automate repo and key installation:

echo "deb https://dl.bintray.com/resin-io/debian stable etcher" | sudo tee /etc/apt/sources.list.d/etcher.list

sudo apt-key adv --keyserver hkp://pgp.mit.edu:80 --recv-keys 379CE192D401AB61

of course you’ll need to include checks to ensure the information has not already been added in previous versions.

Add the following to the postrm file to automate repo and key removal:

sudo rm /etc/apt/sources.list.d/etcher.list

sudo apt-key del 379CE192D401AB61

[dlech]

I don’t understand why you would set up the remote repository after installing the package. The point of setting up the repository is so that you can install the package with apt. Also having a package that removes an apt source when it is uninstalled is unprecedented, so I suspect it would catch a lot of people off guard.

As a separate question, is it worth adding that apt-key del command to here ?

Actually, I wouldn’t use apt-key at all. The “right” way (according to some Debian maintainers I talked to) is to just put the key in /etc/apt/trusted.gpg.d. (apt-key is no longer a required package in Debian since Stretch, so as time goes on, I expect fewer people to have it installed.) So, in the README, I would replace

sudo apt-key adv --keyserver hkp://pgp.mit.edu:80 --recv-keys 379CE192D401AB61

with

curl https://bintray.com/user/downloadSubjectPublicKey?username=bintray | sudo gpg --dearmor --output /etc/apt/trusted.gpg.d/bintray.gpg

This way, if people want to inspect the key first instead of piping directly to gpg, they can.

curl https://bintray.com/user/downloadSubjectPublicKey?username=bintray -O -J
# inspect bintray-public.key.asc
sudo gpg --dearmor --output /etc/apt/trusted.gpg.d/bintray.gpg bintray-public.key.asc
rm bintray-public.key.asc

Then you just have to add this line to the unintall steps:

sudo rm /etc/apt/trusted.gpg.d/bintray.gpg

[lurch]

We’ve had a few sporadic reports of the pgp.mit.edu keyserver being temporarily unavailable, but luckily it usually seems to be a fairly short outage.