private.conf(5)

NAME
private.conf - configuration for apt-transport-private(8).

DESCRIPTION
/etc/apt/private.conf is the configuration file that contains information needed to fetch packages from encrypted remote repositories using apt-transport-private(8). Besides of that, it is also used for encoding repositories using apt-private-prepare(1). As the packages intended to be downloaded using the private method are stored as encrypted files on the remote server, APT needs to decrypt them after download. The decryption is done without need for the user's interaction since the encryption key is loaded from the configuration file. The configuration file is composed of one or multiple HTTP-style plaintext stanzas of key-value pairs. Every remote repository is represented by a separate stanza in the configuration file. The stanzas are separated by one blank line. Every stanza must contain Origin, URI, Cipher, and Key and may optionally contain Salt to increase security (see below for more information). Origin
    The name of the repository. This name connects repository specification in your sources.list(5) and in /etc/apt/private.conf. Any name without white spaces should be valid.
URI
    Represents the real server on which the repository can be found. It can either be an HTTPS or FTP URI. To enforce explicit SSL on FTP protocol, use 'ftpes' as the protocol name. Any URI that is valid for libcurl(3) should work, but only HTTPS and FTPES were tested.
Key
    This field contains the encryption key encoded in hexadecimal. As 256-bit key is expected, value of this field should contain 64 hexadecimal characters, otherwise the helper would fail to extract the key from it.
Cipher
    This field defines the cipher and the mode of operation that is used in the repository. Allowed modes: CBC and CTR; Allowed ciphers: AES. The format of the field is 'mode(cipher)' (in lowercase). The AES is the 256-bit version of the cipher.
Salt
    A random string that can be used for randomisation of the generated file names. Basically, in order to hide the structure of the repository and the filenames, every file in the repository is identified by a unique filename generated by SHA1 of the original path (relative to the root of the repository). The salt can increase randomness and thus make a possible attack a little bit harder.
For an example configuration file see the /usr/share/doc/apt-transport-private/example/private.conf file.

SECURITY WARNING
The keys are stored in plaintext on the disk! Always use randomly generated keys which are not used for encryption of anything else!

LICENSE AND WARRANTY
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

SEE ALSO
apt-transport-private(8), CURLOPT_URL(3).