Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Pushing a Debian package to a registry

Written by
Updated at October 30, 2026
View in Markdown

This guide describes how to push a Debian package to a local registry.

To push a Debian package to a registry, you need the cloud-registry.artifacts.pusher role or higher.

  1. Create the following environment variables depending on the authentication method:

    1. Get an IAM token for the Yandex account or service account you are going to use for authentication.

    2. Create the REGISTRY_USERNAME and REGISTRY_PASSWORD environment variables:

      export REGISTRY_USERNAME="iam"
export REGISTRY_PASSWORD="<IAM_token>"

      Where:

      • REGISTRY_USERNAME: Authentication method.
      • REGISTRY_PASSWORD: Body of the previously obtained IAM token.

    Note

    The IAM token's lifetime is limited to 12 hours.

    1. Create an API key for the service account you are going to use for authentication.

      When creating a key, specify its scope:

      • yc.cloud-registry.artifacts.pull: To pull artifacts from the registry.
      • yc.cloud-registry.artifacts.push: To push artifacts to the registry.

    2. Create the REGISTRY_USERNAME and REGISTRY_PASSWORD environment variables:

      export REGISTRY_USERNAME="api_key"
export REGISTRY_PASSWORD="<API_key>"

      Where:

      • REGISTRY_USERNAME: Authentication method.
      • REGISTRY_PASSWORD: Body of the previously created API key.

    Note

    The API key maximum lifetime is set manually when you create the key.

  2. Run this HTTP request to push your package:

    curl \
  --url-query "dist=<distribution>" \
  --url-query "comp=<component>" \
  --user "${REGISTRY_USERNAME}:${REGISTRY_PASSWORD}" \
  --upload-file "<package>.deb" \
  "https://registry.yandexcloud.net/debian/<registry_ID>"

dput (Debian package upload tool) is a utility for pushing packages to Debian repositories.

  1. Select the authentication method:

    Get an IAM token for the Yandex account or service account you are going to use for authentication.

    Note

    The IAM token's lifetime is limited to 12 hours.

    Create an API key for the service account you are going to use for authentication.

    When creating a key, specify its scope:

    • yc.cloud-registry.artifacts.pull: To pull artifacts from the registry.
    • yc.cloud-registry.artifacts.push: To push artifacts to the registry.

    Note

    The API key maximum lifetime is set manually when you create the key.

  2. Add the following registry configuration to the /etc/dput.cf file:

    [ycr]
fqdn = registry.yandexcloud.net
incoming = /debian/<registry_ID>/upload/
login = iam
method = https
allow_unsigned_uploads = 1

    [ycr]
fqdn = registry.yandexcloud.net
incoming = /debian/<registry_ID>/upload/
login = api_key
method = https
allow_unsigned_uploads = 1

  3. Upload the package:

    dput ycr <package>.changes

    Where <package>.changes is the package change file generated during the compilation.

Useful links

Scope is an API key parameter that restricts the key's use to specific operations in addition to the service account's access permissions. For details, see API keys with scope and validity limits.

Previous
Configuring APT
Next
Pulling a Debian package from a registry