Integrate GPG signing for Debian repository to prevent package injection attacks

[Copilot]

The Debian repository was published with -skip-signing and instructed clients to use Trusted: yes, removing cryptographic verification. This allowed arbitrary package injection via compromised HTTPS or GitHub Pages.

Changes

Pipeline (azure-pipelines-release.yml)

• Generate 4096-bit RSA GPG key during deployment
• Sign repository with aptly publish -gpg-key instead of -skip-signing
• Export public key to repo/public/log4tc-archive-keyring.gpg and repo/public/dists/stable/

Client Configuration (CONTRIBUTING.md, docs/reference/installation.md)

• Replace Trusted: yes with Signed-By: /etc/apt/trusted.gpg.d/log4tc-archive-keyring.gpg
• Add GPG key installation step: wget -qO- https://mbc-engineering.github.io/log4TC/deb/log4tc-archive-keyring.gpg | sudo tee /etc/apt/trusted.gpg.d/log4tc-archive-keyring.gpg

Before:

Types: deb
URIs: https://mbc-engineering.github.io/log4TC/deb
Suites: stable
Components: main
Trusted: yes  # ❌ Bypasses signature verification

After:

Types: deb
URIs: https://mbc-engineering.github.io/log4TC/deb
Suites: stable
Components: main
Signed-By: /etc/apt/trusted.gpg.d/log4tc-archive-keyring.gpg  # ✅ Verifies signatures

Addresses review feedback from PR #40.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.