From 8ed4c8cab1c34108f1191cae11b3ab804bea53b9 Mon Sep 17 00:00:00 2001 From: Steve Brown Date: Fri, 16 Oct 2026 23:51:59 -0400 Subject: [PATCH 1/2] docs: install from the signed apt repository Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01SQEo4QwpFfFKTTVqTPH9sH --- README.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/README.md b/README.md index a09d4d9..cc83fce 100644 --- a/README.md +++ b/README.md @@ -43,6 +43,26 @@ skill guides you through the same workflow. ## Install +**Debian and Ubuntu (amd64):** install from the signed apt repository, +which republishes each checksum-verified release, so `apt upgrade` (or +unattended-upgrades) keeps it current. The package puts `tambo` and the +compatibility `caboodle` command in `/usr/bin`. + +```bash +sudo install -d -m 0755 /etc/apt/keyrings +curl -fsSL https://scbrown.github.io/apt/key.gpg | sudo tee /etc/apt/keyrings/scbrown-stack.gpg >/dev/null +echo "deb [signed-by=/etc/apt/keyrings/scbrown-stack.gpg] https://scbrown.github.io/apt stable main" \ + | sudo tee /etc/apt/sources.list.d/scbrown-stack.list +sudo apt update && sudo apt install tambo +``` + +Before trusting the key, `gpg --show-keys /etc/apt/keyrings/scbrown-stack.gpg` +must print `AB5625C5612F643BF76464DF0DC99924994EC959`. A host with the older +`caboodle` package moves over with `sudo apt install tambo` (or +`apt full-upgrade`): `caboodle 0.3.4-1` is a transitional package that depends +on `tambo`. Channels, pinning and rollback: +[scbrown/apt](https://github.com/scbrown/apt#channels-and-pinning). + Checksummed releases: Linux x86_64, macOS arm64 and macOS x86_64. The installer verifies SHA256 before placing the binary in `~/.cargo/bin`. From 82533943a43ad668e5685e7a469e27261414b557 Mon Sep 17 00:00:00 2001 From: Steve Brown Date: Sat, 17 Oct 2026 00:36:47 -0400 Subject: [PATCH 2/2] docs: verify the apt signing key before trusting it Review (quipu#645): the fingerprint check came after apt install, and unattended-upgrades only upgrades third-party origins that are allowed. Check the key first and stop on a mismatch, and name the origin pattern. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01SQEo4QwpFfFKTTVqTPH9sH --- README.md | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index cc83fce..a728fc8 100644 --- a/README.md +++ b/README.md @@ -43,24 +43,28 @@ skill guides you through the same workflow. ## Install -**Debian and Ubuntu (amd64):** install from the signed apt repository, -which republishes each checksum-verified release, so `apt upgrade` (or -unattended-upgrades) keeps it current. The package puts `tambo` and the -compatibility `caboodle` command in `/usr/bin`. +**Debian and Ubuntu (amd64):** install from the signed apt repository, which +republishes each checksum-verified release. The package puts `tambo` and the compatibility `caboodle` command in +`/usr/bin`. Check the signing key's fingerprint before trusting it; the +commands stop if it does not match: ```bash -sudo install -d -m 0755 /etc/apt/keyrings -curl -fsSL https://scbrown.github.io/apt/key.gpg | sudo tee /etc/apt/keyrings/scbrown-stack.gpg >/dev/null -echo "deb [signed-by=/etc/apt/keyrings/scbrown-stack.gpg] https://scbrown.github.io/apt stable main" \ - | sudo tee /etc/apt/sources.list.d/scbrown-stack.list -sudo apt update && sudo apt install tambo +curl -fsSL https://scbrown.github.io/apt/key.gpg -o scbrown-stack.gpg +gpg --show-keys --with-colons scbrown-stack.gpg \ + | grep -qx 'fpr:::::::::AB5625C5612F643BF76464DF0DC99924994EC959:' \ + && sudo install -D -m 0644 scbrown-stack.gpg /etc/apt/keyrings/scbrown-stack.gpg \ + && echo "deb [signed-by=/etc/apt/keyrings/scbrown-stack.gpg] https://scbrown.github.io/apt stable main" \ + | sudo tee /etc/apt/sources.list.d/scbrown-stack.list \ + && sudo apt update && sudo apt install tambo ``` -Before trusting the key, `gpg --show-keys /etc/apt/keyrings/scbrown-stack.gpg` -must print `AB5625C5612F643BF76464DF0DC99924994EC959`. A host with the older -`caboodle` package moves over with `sudo apt install tambo` (or -`apt full-upgrade`): `caboodle 0.3.4-1` is a transitional package that depends -on `tambo`. Channels, pinning and rollback: +`apt upgrade` then picks up new releases. unattended-upgrades only installs +from origins it allows, so to have it upgrade tambo too, add +`"origin=scbrown,codename=stable";` to `Unattended-Upgrade::Origins-Pattern`. +A host with the older `caboodle` package moves over with +`sudo apt install tambo` (or `apt full-upgrade`): `caboodle 0.3.4-1` is a +transitional package that depends on `tambo`. +Channels, pinning and rollback: [scbrown/apt](https://github.com/scbrown/apt#channels-and-pinning). Checksummed releases: Linux x86_64, macOS arm64 and macOS x86_64.