Some arkanelinux deployments missing signature file

[user1-github]

Probably unrelated to Arkdep, but looking at repo.arkanelinux.org/arkdep/arkanelinux , I see that from time to time some deployments are missing their signature file - particularly 2024-09-08, 2024-10-09 and 2024-11-30.

When doing "sudo arkdep deploy" it doesn't cause any issue with the update, the signuture check just fails and the update continues as usual. But for the sake of security, it's better to make sure that every new deployment has its signature file.

[dennis1248]

My fault, I sometimes forget to generate the signature because it is a manual process. I will automate this soon so it can't go wrong anymore.

I plan on automating the entire image creation process, so it automatically generates new images according to a set schedule.

I pushed a sig for 2024-11-30.

[user1-github]

Thanks, also a suggestion - Arkdep should stop the update in case the sig file is not found, because I think that could theoretically be exploited.

[dennis1248]

Thanks, also a suggestion - Arkdep should stop the update in case the sig file is not found, because I think that could theoretically be exploited.

If you set gpg_signature_check in /arkdep/config to 2 it will force this requirement. I will make this default in a future ISO release.