apt signed-by test repository isolation with apt_preferences pinning
Goal is to evaluate a Debian package integration against a non-production repository without using production credentials or keys. apt supports separate sources.list entries and apt_preferences pinning for test suites, and signed-by allows a dedicated keyring per repository to isolate verification from production keys. The unresolved decision is how to trust
debian