SDODS apt repository

This address is a Debian package repository rather than a page — it is meant to be read by apt, not a browser. Point a Debian or Ubuntu machine at it and apt upgrade will keep the SDODS desktop app current.

Add it

Three commands, run once. The key is dearmoured on the way in because apt reads binary keyrings, and an armoured file in that directory fails with an error that blames the signature rather than the format.

1. Install the signing key

curl -fsSL https://sdods.com/apt/sdods-archive-keyring.gpg | sudo tee /usr/share/keyrings/sdods-archive-keyring.gpg > /dev/null

2. Add the source

echo "deb [signed-by=/usr/share/keyrings/sdods-archive-keyring.gpg] https://sdods.com/apt stable main" | sudo tee /etc/apt/sources.list.d/sdods.list

One suite, stable, and one component, main. It is deliberately not a flat repository: a flat one is addressed with a ./ distribution, and every path apt then builds carries a ./ segment that this host answers with a redirect to nowhere.

3. Install

sudo apt update && sudo apt install sdods

What is served here

dists/stable/InRelease

The signed index. apt reads this first and verifies it against the key below.

dists/stable/Release · Release.gpg

The same index with a detached signature, for older apt clients.

dists/stable/main/binary-{amd64,arm64}/Packages

What is available for each architecture, with the size and SHA-256 of every package.

sdods-archive-keyring.gpg

The public half of the signing key, in the binary form apt reads.

The .deb files themselves are not stored here. They are over a hundred megabytes each, so they stay on the public release and pool/ redirects there. apt checks every download against the SHA-256 in Packages, so a package fetched through the redirect is verified exactly as one served directly would be.

The signing key

Check that the key you installed is this one before trusting the repository:

gpg --show-keys /usr/share/keyrings/sdods-archive-keyring.gpg

D99D DCC3 AD1C 15D6 E20B  C961 BED3 7DAF 8308 7449

If you would rather not add a source

A single .deb installs the same application and never updates itself. Every platform’s direct download is on the download page.