🔑 How the subscription works

🧾 1. What happens when you pay

1. You complete checkout on Stripe. Card details go to Stripe and never touch this server.
2. Stripe confirms the payment and notifies the repository. This is the moment access is created, not the moment the checkout page closes, so a payment still being authorised takes a little longer.
3. Your account is created and a password is generated for it, at random, on the server.
4. An email is sent to the address you gave Stripe, containing your login, your password, and the four setup commands. It is the only time that password is ever transmitted.

If it has not arrived within a few minutes, check spam first, then ask in Discord. That is the fastest way to get it sorted, and the account can be looked up by the email you paid with.

🔐 2. What the credentials are

Because only the hash is stored, a lost password cannot be recovered, but a new one can be issued on request. Reply to the welcome email or ask in Discord, and you get fresh credentials; the old password stops working the moment the new one is issued. Keep the welcome email, or better, put the password in your password manager.

🖥️ 3. How apt authenticates

Plain HTTP Basic authentication over HTTPS: the mechanism apt has supported natively for years, with no plugin, no helper binary and no extra package. Credentials belong in /etc/apt/auth.conf.d/, never in the sources.list line, where every user on the machine could read them and apt would leak them in error messages:

sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | sudo tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null
sudo install -m 600 /dev/null /etc/apt/auth.conf.d/deb.griffo.io.conf
sudo tee /etc/apt/auth.conf.d/deb.griffo.io.conf > /dev/null <<'EOF'
machine deb.griffo.io
login your-email@example.com
password your-subscription-password
EOF
sudo apt update

install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null
install -m 600 /dev/null /etc/apt/auth.conf.d/deb.griffo.io.conf
tee /etc/apt/auth.conf.d/deb.griffo.io.conf > /dev/null <<'EOF'
machine deb.griffo.io
login your-email@example.com
password your-subscription-password
EOF
apt update

sudo apt install extrepo
sudo extrepo enable griffo
sudo install -m 600 /dev/null /etc/apt/auth.conf.d/deb.griffo.io.conf
sudo tee /etc/apt/auth.conf.d/deb.griffo.io.conf > /dev/null <<'EOF'
machine deb.griffo.io
login your-email@example.com
password your-subscription-password
EOF
sudo apt update

That is the whole integration. Three details matter, and they are the three things that go wrong: the machine line is bare, deb.griffo.io, with no https://, no trailing slash and no /apt path; the filename ends in .conf, because apt silently ignores any other extension; and the file is root-owned and mode 600, because apt refuses to read credentials other users can read, which is why the file is created empty at mode 600 above, before the password is written into it. If apt returns 401, the full checklist is here →

Every request is checked against the database at the moment it is made: the login, the password hash, and whether a subscription behind that account is currently active. Nothing is cached and nothing is issued to your machine, which is why a renewal, a cancellation or a new password takes effect immediately, with no action on your side.

🏗️ 4. Servers, containers and CI

One set of credentials covers every machine you run, workstation, laptops, servers, build agents. Drop the same auth.conf.d file on each, or mount it as a secret in CI. What you should not do is bake it into a container image that gets pushed to a public registry: it is a password in a file, and it travels with whatever you copy it into. For images, prefer a build secret, or install the .deb from its public GitHub release, which needs no credentials at all.

🔄 5. Yearly subscription, the full lifecycle

♾️ 6. Lifetime, what is different

Lifetime is a single payment, not a subscription. There is nothing to renew and nothing to cancel, no card on file to expire, and price changes do not reach you. The credentials work exactly the same way, same login, same auth.conf.d file, same everything. If you already had a yearly subscription and upgrade, you keep the credentials you have; you get a confirmation email rather than a new password. The one thing that ends lifetime access is a refund.

🚦 7. What needs no subscription at all

So you can add the repository, run apt update and see exactly which versions are on offer before paying anything. The always-free mirror is explained here →

🗃️ 8. What is stored about you

Your email address, the Stripe customer reference, the bcrypt hash of your password, and the dates of your subscription. That is the entire record. Payment details are handled by Stripe and never reach this server. The only emails sent are the ones the service itself requires: your credentials, a confirmation when lifetime access is activated, and a notice when access ends. No marketing, no list. Terms & Conditions →

❓ Still unsure?

Ask before you pay, the Discord is the fastest way to reach me, and questions about how any of this works are welcome. If you supported the project on Buy Me a Coffee in the past, come and say so there: you get a free lifetime subscription.

← Back to pricing