Introduction
This article explains how to create Artifactory remote repositories to proxy RabbitMQ's Debian/Ubuntu apt packages and their OpenPGP signing key, based on RabbitMQ's official installation guide.
1. Configure the Remote Repositories
Create three Remote repositories and update their configuration with the URLs below to ensure packages are downloaded from the correct upstream endpoints:
-
Debian remote repository "rabbitmq-erlang-debian-remote"
-
URL: https://deb1.rabbitmq.com/rabbitmq-erlang/ubuntu/noble
-
Debian remote repository "rabbitmq-server-debian-remote"
-
URL: https://deb1.rabbitmq.com/rabbitmq-server/ubuntu/noble
-
Generic remote repository "rabbitmq-signing-key-generic-remote"
-
URL: https://keys.openpgp.org
Note:
Replace "noble" with your target Ubuntu/Debian (e.g. jammy, focal, bookworm, bullseye, trixie) to match the clients you are supporting. If you are updating an existing repository, delete the contents of the remote-cache repository first to remove any outdated or broken artifacts.
2. Retrieve and Trust the Signing Key
Fetch RabbitMQ's signing key through the proxied repository instead of reaching “keys.openpgp.org” directly, then import it the same way the official installation guide does:
curl -1sLf
"https://<JFROG_URL>/artifactory/rabbitmq-signing-key-generic-remote/vks/v1/by-fingerprint/0A9AF2115F4687BD29803A206B73A36E6026DFCA"
| sudo gpg --dearmor -o /usr/share/keyrings/com.rabbitmq.team.gpg
3. Point Your Clients at the Remote Repositories
Add the following lines to your client's /etc/apt/sources.list (or a new file under /etc/apt/sources.list.d/), replacing <JFROG_URL> with your instance URL. The signed-by clause must point to the keyring created in Step 2, otherwise, apt will fail to verify the repository, for example:
deb [arch=amd64 signed-by=/usr/share/keyrings/com.rabbitmq.team.gpg]
https://<JFROG_URL>/artifactory/rabbitmq-erlang-debian-remote noble main
deb [arch=amd64 signed-by=/usr/share/keyrings/com.rabbitmq.team.gpg]
https://<JFROG_URL>/artifactory/rabbitmq-server-debian-remote noble main
Note:
If you prefer a single combined apt source line instead of two, aggregate both Debian remotes under a Virtual Debian repository (for example "rabbitmq-debian-virtual") and point apt at that repository instead. A Virtual Debian repository only signs its recalculated Release/InRelease metadata if a GPG key pair has been assigned to it under Administration > Security > Keys Management. Without one assigned, apt will fail with "repository ... is not signed".
If a key is assigned, your client needs to trust that key instead of RabbitMQ's original one, retrievable via: https://<JFROG_URL>/artifactory/api/security/keypair/public/repositories/rabbitmq-debian-virtual.
See "How to use GPG Keys with Artifactory Debian Repositories" for full details on configuring and rotating this key.
4. Update and Install
Finally, refresh your local package index and install RabbitMQ against your Artifactory remote repositories.
sudo apt-get update
sudo apt-get install rabbitmq-server -y
Verified example output (RabbitMQ packages are amd64 only, so run this on an amd64 host or with amd64 emulation enabled):
$ sudo apt-get update
Get:5 https://<JFROG_URL>/artifactory/rabbitmq-erlang-debian-remote noble InRelease [4350 B]
Get:6 https://<JFROG_URL>/artifactory/rabbitmq-server-debian-remote noble InRelease [17.2 kB]
Get:7 https://<JFROG_URL>/artifactory/rabbitmq-erlang-debian-remote noble/main amd64 Packages [261 kB]
Get:8 https://<JFROG_URL>/artifactory/rabbitmq-server-debian-remote noble/main amd64 Packages [8507 B]
Fetched 291 kB in 4s (67.2 kB/s)
Reading package lists... Done
$ sudo apt-get install rabbitmq-server -y
...
Setting up erlang-ssl (1:27.3.4.16-1) ...
Setting up rabbitmq-server (4.3.5-1) ...
info: Adding group `rabbitmq' (GID 103) ...
info: Adding system user `rabbitmq' (UID 102) ...
Created symlink /etc/systemd/system/multi-user.target.wants/rabbitmq-server.service to
/usr/lib/systemd/system/rabbitmq-server.service.
Please make sure these URLs are whitelisted:
-
"keys.openpgp.org" - source for the GPG signing key used to verify RabbitMQ's packages.
-
"deb1.rabbitmq.com" (or "deb2.rabbitmq.com") - source for the rabbitmq-erlang and rabbitmq-server apt package repositories.