Packaging step-ca for debian

[pymnh]

Hi,

just letting you know that I have been packaging step-ca for debian. It has just been uploaded yesterday so it won't be available for users of the next stable release that is scheduled for this week though and will probably be around in experimental-part of the distro for some while.

Will let you know once it is available in the debian archives :)

[maraino]

Great contribution 🙌

[tashian]

Here's the package on debian.org in the experimental section

[dopey]

Hey @pymnh really appreciate the work you're doing on this! Is step (github.com/smallstep/cli) already packaged for debian or being packaged simultaneously. It might be difficult to use step-ca without step.

[pymnh]

Hi @dopey
I have been packaging libraries from github.com/smallstep/cli so some extend and intend to package its compiled cli utility in near future. Right know this only includes development libraries needed for another package, namely Caddy.

Obstacles here are the complex build-dependencies of step and Debians packaging workflow: Debian build servers do not pull from web and it is strongly discouraged to vendor dependencies, hence each of the direct and indirect build-deps need to be packaged for the Debian archives.
So before step can be packaged, some zmap packages need to be packaged first (and are on the wishlist of some people at Debian anyway). Once those are in the archives, one could either go and package the smallstep/{zcrypto,zlint) forks or consider applying patches to existing zmap libraries in some way that does not break its intended functionality.

This is something that I will have investigate. Maintaining both zmap libraries and their smallstep forks wouldn't be ideal, but maintaining a huge delta of downstream paches maybe even less so. Once this is figured out, packaging step should be no big deal

[maraino]

@pymnh Let us know how can we help to simplify things for Debian. For example, we're using a custom version of zmap/zcrypto would it be better to have it for example in cli/pkg/zcrypto instead of using an "external" dependency as we do right now.