CodeIT repository
nginx and Apache httpd builds with HTTP/3, TLS 1.3 and Brotli, for Ubuntu and Debian.
Supported: Ubuntu 22.04 (jammy) and
Ubuntu 24.04 (noble), on amd64 and
arm64. Ubuntu derivatives such as Linux Mint work — use the Ubuntu
release they are based on.
Quick install
Detects your release and installs the matching repository package:
curl -fsSL https://repo.codeit.guru/setup | sudo sh
To see exactly what it would do without changing anything:
curl -fsSL https://repo.codeit.guru/setup | sh -s -- --print
That is all it does: work out your release and install one package. If you would rather not pipe a script into a shell, use the next section — same result.
Install without the script
Pick your release. The package installs the apt source and the signing key.
Ubuntu 24.04 — noble
curl -fsSLO https://repo.codeit.guru/codeit-repo-release.noble.deb
sudo dpkg -i codeit-repo-release.noble.deb
sudo apt-get update
Ubuntu 22.04 — jammy
curl -fsSLO https://repo.codeit.guru/codeit-repo-release.jammy.deb
sudo dpkg -i codeit-repo-release.jammy.deb
sudo apt-get update
Which release am I on?
. /etc/os-release; echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}"
On Mint, Pop!_OS and similar, UBUNTU_CODENAME is the one to use —
VERSION_CODENAME holds the derivative’s own name, which is not a
suite we publish.
There is one package per release because apt, unlike dnf, cannot expand a variable inside a sources file: the codename has to be written out.
Verified install
For people who would rather read a package before installing it. Every step is optional; the outcome is identical.
Replace jammy with your release throughout.
1. Download it, without installing
curl -fsSLO https://repo.codeit.guru/codeit-repo-release.jammy.deb
2. Read what it contains
dpkg -I codeit-repo-release.jammy.deb # control data, dependencies
dpkg -c codeit-repo-release.jammy.deb # every file it installs
Two files: an apt source and a keyring. There are no maintainer scripts, so the package runs no code when it is installed.
3. Read the apt source it will add
dpkg-deb --fsys-tarfile codeit-repo-release.jammy.deb \
| tar -xO ./etc/apt/sources.list.d/codeit.sources
4. Check the key against the fingerprint published below
dpkg-deb --fsys-tarfile codeit-repo-release.jammy.deb \
| tar -xO ./usr/share/keyrings/codeit-archive-keyring.asc \
| gpg --show-keys --with-fingerprint
Compare it with the table in Signing keys.
Where trust actually comes from. The package is fetched over
HTTPS and is not itself signed — on apt it is the repository’s
Release file that carries the signature, and that only helps once
the key is installed. So the fingerprint check above is the step that matters,
and it is only as good as your confidence in this page. If that is not enough
for your threat model, obtain the fingerprint from a second channel first.
5. Install the file you just inspected
sudo dpkg -i ./codeit-repo-release.jammy.deb
sudo apt-get update
Install packages
sudo apt-get install -y nginx
sudo apt-get install -y apache2
Both families are in one suite, so there is nothing to enable first — the module streams on the Enterprise Linux side have no apt equivalent.
To pin a package to this repository, or to check where one would come from:
apt policy nginx
Check it worked
apt policy | grep -i codeit
ls -l /etc/apt/sources.list.d/codeit.sources
ls -l /usr/share/keyrings/codeit-archive-keyring.asc
A successful apt-get update with no NO_PUBKEY or
signature warning means the repository’s Release file
verified against the installed key.
Testing suite
A second, disabled entry is installed for pre-release builds. Turn it on by
changing Enabled: no to Enabled: yes in the second
stanza:
sudoedit /etc/apt/sources.list.d/codeit.sources
sudo apt-get update
The testing suite carries builds that have not been released. Do not leave it enabled on anything you care about.
Signing keys
Ubuntu and Debian packages are signed with one key.
| Used for | Key | Fingerprint |
|---|---|---|
| Ubuntu, Debian EL 8, 9, 10 | MasterOfDevon
<[email protected]>
RSA 2048, 2021-12-08 |
A841 3774 B3FA A303 D8A6 CD79 5F53 E10D 0918 7DCD |
Print the fingerprint of what is installed on your machine:
gpg --show-keys --with-fingerprint /usr/share/keyrings/codeit-archive-keyring.asc
The key is not added to apt’s global keyring, and should not
be. It is installed as a file and referenced by
Signed-By: in codeit.sources, so it can vouch for this
repository and nothing else. A key added with apt-key is trusted
for every repository on the system, which is why that command is
deprecated and gone from current releases.
Removing the repository
sudo apt-get remove -y codeit-repo-release
sudo apt-get update
That takes the apt source and the keyring with it. Packages you already installed stay; remove them first if you want them gone.
