Add signed-by support to Debian APT repository

build.mill

@@ -1849,6 +1849,33 @@ object ci extends Module {
     )
       .call(cwd = debianDir, stdin = pgpPassphrase, stdout = inReleasePath)
 
+    // Export the public key as a binary (non-armored) keyring at the repo root so that
+    // users can reference it via `signed-by` in their APT sources.
+    // Binary format is required per https://wiki.debian.org/DebianRepository/UseThirdParty
+    val keyringPath = packagesDir / "scala-cli-archive-keyring.gpg"
+    os.proc("gpg", "--batch", "--yes", "--export", keyName)
+      .call(stdout = keyringPath)
+
+    // Update the .list file to include the signed-by option pointing at the keyring.
+    // This scopes the key to this repository only, preventing the globally-trusted key
+    // security issue described in the Debian wiki.
+    os.write.over(
+      debianDir / "scala_cli_packages.list",
+      "deb [signed-by=/etc/apt/keyrings/scala-cli-archive-keyring.gpg] https://virtuslab.github.io/scala-cli-packages/debian ./\n"
+    )
+
+    // Also provide a DEB822 .sources file for users on modern Debian (apt modernize-sources).
+    // No Components field: this is a flat repository (Suites: ./).
+    // No Architectures field: avoids breaking when aarch64 packages are added later.
+    os.write.over(
+      debianDir / "scala_cli_packages.sources",
+      """Types: deb
+        |URIs: https://virtuslab.github.io/scala-cli-packages/debian
+        |Suites: ./
+        |Signed-By: /etc/apt/keyrings/scala-cli-archive-keyring.gpg
+        |""".stripMargin
+    )
+
     commitChanges(s"Update Debian packages for $version", branch, packagesDir)
   }
   def updateChocolateyPackage(): Command[os.CommandResult] = Task.Command {

website/docs/_advanced_install.mdx

@@ -83,7 +83,8 @@ scala-cli version
 Scala CLI can be installed via [apt](https://wiki.debian.org/Apt) packager tool.
 
 ```bash
-curl -sS "https://virtuslab.github.io/scala-cli-packages/KEY.gpg" | sudo gpg --dearmor  -o /etc/apt/trusted.gpg.d/scala-cli.gpg 2>/dev/null
+sudo mkdir -p /etc/apt/keyrings
+curl -sS "https://virtuslab.github.io/scala-cli-packages/scala-cli-archive-keyring.gpg" | sudo tee /etc/apt/keyrings/scala-cli-archive-keyring.gpg > /dev/null
 sudo curl -s --compressed -o /etc/apt/sources.list.d/scala_cli_packages.list "https://virtuslab.github.io/scala-cli-packages/debian/scala_cli_packages.list"
 sudo apt update
 sudo apt install scala-cli