Ubuntu and Debian repository instructions

CodeIT repository

nginx and Apache httpd builds with HTTP/3, TLS 1.3 and Brotli, for Ubuntu and Debian.

Supported: Ubuntu 22.04 (jammy) and Ubuntu 24.04 (noble), on amd64 and arm64. Ubuntu derivatives such as Linux Mint work — use the Ubuntu release they are based on.

Quick install

Detects your release and installs the matching repository package:

curl -fsSL https://repo.codeit.guru/setup | sudo sh

To see exactly what it would do without changing anything:

curl -fsSL https://repo.codeit.guru/setup | sh -s -- --print

That is all it does: work out your release and install one package. If you would rather not pipe a script into a shell, use the next section — same result.

Install without the script

Pick your release. The package installs the apt source and the signing key.

Ubuntu 24.04 — noble

curl -fsSLO https://repo.codeit.guru/codeit-repo-release.noble.deb
sudo dpkg -i codeit-repo-release.noble.deb
sudo apt-get update

Ubuntu 22.04 — jammy

curl -fsSLO https://repo.codeit.guru/codeit-repo-release.jammy.deb
sudo dpkg -i codeit-repo-release.jammy.deb
sudo apt-get update

Which release am I on?

. /etc/os-release; echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}"

On Mint, Pop!_OS and similar, UBUNTU_CODENAME is the one to use — VERSION_CODENAME holds the derivative’s own name, which is not a suite we publish.

There is one package per release because apt, unlike dnf, cannot expand a variable inside a sources file: the codename has to be written out.

Verified install

For people who would rather read a package before installing it. Every step is optional; the outcome is identical.

Replace jammy with your release throughout.

1. Download it, without installing

curl -fsSLO https://repo.codeit.guru/codeit-repo-release.jammy.deb

2. Read what it contains

dpkg -I codeit-repo-release.jammy.deb    # control data, dependencies
dpkg -c codeit-repo-release.jammy.deb    # every file it installs

Two files: an apt source and a keyring. There are no maintainer scripts, so the package runs no code when it is installed.

3. Read the apt source it will add

dpkg-deb --fsys-tarfile codeit-repo-release.jammy.deb \
  | tar -xO ./etc/apt/sources.list.d/codeit.sources

4. Check the key against the fingerprint published below

dpkg-deb --fsys-tarfile codeit-repo-release.jammy.deb \
  | tar -xO ./usr/share/keyrings/codeit-archive-keyring.asc \
  | gpg --show-keys --with-fingerprint

Compare it with the table in Signing keys.

Where trust actually comes from. The package is fetched over HTTPS and is not itself signed — on apt it is the repository’s Release file that carries the signature, and that only helps once the key is installed. So the fingerprint check above is the step that matters, and it is only as good as your confidence in this page. If that is not enough for your threat model, obtain the fingerprint from a second channel first.

5. Install the file you just inspected

sudo dpkg -i ./codeit-repo-release.jammy.deb
sudo apt-get update

Install packages

sudo apt-get install -y nginx
sudo apt-get install -y apache2

Both families are in one suite, so there is nothing to enable first — the module streams on the Enterprise Linux side have no apt equivalent.

To pin a package to this repository, or to check where one would come from:

apt policy nginx

Check it worked

apt policy | grep -i codeit
ls -l /etc/apt/sources.list.d/codeit.sources
ls -l /usr/share/keyrings/codeit-archive-keyring.asc

A successful apt-get update with no NO_PUBKEY or signature warning means the repository’s Release file verified against the installed key.

Testing suite

A second, disabled entry is installed for pre-release builds. Turn it on by changing Enabled: no to Enabled: yes in the second stanza:

sudoedit /etc/apt/sources.list.d/codeit.sources
sudo apt-get update

The testing suite carries builds that have not been released. Do not leave it enabled on anything you care about.

Signing keys

Ubuntu and Debian packages are signed with one key.

Used for Key Fingerprint
Ubuntu, Debian EL 8, 9, 10 MasterOfDevon <[email protected]> RSA 2048, 2021-12-08 A841 3774 B3FA A303 D8A6  CD79 5F53 E10D 0918 7DCD

Print the fingerprint of what is installed on your machine:

gpg --show-keys --with-fingerprint /usr/share/keyrings/codeit-archive-keyring.asc

The key is not added to apt’s global keyring, and should not be. It is installed as a file and referenced by Signed-By: in codeit.sources, so it can vouch for this repository and nothing else. A key added with apt-key is trusted for every repository on the system, which is why that command is deprecated and gone from current releases.

Removing the repository

sudo apt-get remove -y codeit-repo-release
sudo apt-get update

That takes the apt source and the keyring with it. Packages you already installed stay; remove them first if you want them gone.