# apt-swarm

An attempt to make a secure public p2p protocol that gossips about signed
`InRelease` files to implement an update transparency log.

![Screenshot of a keyring along with the number of known signatures](.github/keyring-screenshot.png)

## Running a node

<a href="https://repology.org/project/apt-swarm/versions"><img align="right" src="https://repology.org/badge/vertical-allrepos/apt-swarm.svg" alt="Packaging status"></a>

Install dependencies (Arch Linux):

```
pacman -S podman
```

Install dependencies (Debian/Ubuntu):

```
apt-get install podman catatonit
```

Create a systemd service at `/etc/systemd/system/apt-swarm.service`:

```
cat > /etc/systemd/system/apt-swarm.service <<EOF
[Unit]
Description=apt-swarm p2p container
Documentation=https://github.com/kpcyrd/apt-swarm

[Service]
ExecStartPre=-/usr/bin/mkdir -p /opt/apt-swarm
ExecStart=/usr/bin/podman run --rm --pull always --init \
    -v /opt/apt-swarm:/data \
    -p 16169:16169 \
    ghcr.io/kpcyrd/apt-swarm:edge p2p \
    --check-container-updates ghcr.io/kpcyrd/apt-swarm:edge
Restart=always
RestartSec=10

[Install]
WantedBy=default.target
EOF
```

Start the service:

```
systemctl daemon-reload
systemctl enable --now apt-swarm
```

Watch logs:

```
journalctl -fu apt-swarm
```

## Running a node (kubernetes)

```
minikube start
kubectl create ns apt-swarm 2>/dev/null || true
kubectl apply -f contrib/k8s.yaml -n apt-swarm
```

## Configuring a repository to monitor

To ascii armor the pgp key use this command:

```
sq packet armor < contrib/signal-desktop-keyring.pgp
```

Then write a configuration like this:

```toml
[[repository]]
urls = ["https://updates.signal.org/desktop/apt/dists/xenial/InRelease"]
keyring = """
-----BEGIN PGP PUBLIC KEY BLOCK-----


N+O606NOXLwcmq5KZL0g
=zyVo
-----END PGP PUBLIC KEY BLOCK-----
"""
```

## Status

This project is experimental. PGP is complicated and p2p security is difficult,
running this program may use up a lot of disk space on your computer if
somebody finds a way to bypass the vandalism protection.

There's also the risk of a false-negative, the pgp implementation used by
apt-get may consider a signature as valid that we consider invalid. If
apt-swarm considers the signature as invalid it won't accept this release into
the network and it won't appear in your audit logs.

apt-swarm can't detect network-partitioning attacks and doesn't intend to.

[![Star History Chart](https://api.star-history.com/svg?repos=kpcyrd/apt-swarm&type=Date)](https://www.star-history.com/#kpcyrd/apt-swarm&Date)

## Trivia

As part of this project, a [bug causing the pgp parser to
crash](https://gitlab.com/sequoia-pgp/sequoia/-/issues/1005) was identified in
Sequoia OpenPGP in 2023 through fuzzing.

A bug that could in some cases lead to [silent data
loss](https://github.com/tokio-rs/tokio/issues/7174) was identified in Tokio in
2025.

## Funding

[![](.github/lolgpt.png)](https://github.com/sponsors/kpcyrd)

## License

`GPL-3.0-or-later`
