2

I am writing an advanced cross-platform open-source application. It is commercial app, but free&open-source (GPLv3).
The thing is, this app is related to data security, so we need, that the source code could be easily reviewed by the community.

  1. Will it be better to distribute this app using own Debian repository (created with reprepro, for example) or creating a PPA?

  2. What are the advantages of creating a PPA instead of own repository (+ build server)?

  3. Do PPA's provide their own guarantee, that the binary package was generated from respective source package, so the community could be sure, that the binaries are generated from source without backdoors?

2

1 Answer 1

2

I'll address the three parts of your question:

  1. I think it's matter of opinion. As a user, I don't have any preferences for either of those. As a developer, I mainly use PPAs for the reasons below.

  2. The more obvious are that you use Canonical's resources instead of your own, and that includes the GPG key management, for your users. Remember that when one adds a PPA using the ppa:you/yourpackage shortcut, everything is taken care of. Contrast this to the scenario where you have to instruct the user on getting your gpg key, adding it to APT, etc. Additionally it builds packages for several Ubuntu releases, once the package is "buildable".

  3. Packages in a PPA are already crypto-signed. Launchpad will check out the source from wherever you deploy, build it and sign it with your PPA key. If you require more security (say, to prevent anyone from intercepting inside Launchpad), then you should use your own repository, and sign the package yourself. This is a rather 'tinfoil hat' scenario where you would prefer to manage your own repo, rather than trusting Launchpad. Also a matter of opinion like in 1.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .