feat: update version to 2026.9.7 in pyproject.toml

Signed-off-by: d9pouces <github@19pouces.net>

tests/dockerfiles/repos/apt-repo.Dockerfile

@@ -1,12 +1,18 @@
 # Minimal flat-format APT repository serving one hand-built .deb package over
 # TLS, used by tox-docker to exercise the `apt` module integration test
-# (tests/configs/Apt.yaml.tmpl, tests/dockerfiles/Apt.Dockerfile).
+# (tests/configs/Apt.yaml.j2, tests/dockerfiles/Apt.Dockerfile). Its
+# InRelease file is genuinely signed with the dedicated key pair
+# apt-signing-key.key.asc / apt-signing-key.pub.asc, whose public half is
+# what tests/configs/Apt.yaml.j2 embeds as the configured source's
+# `signed-by`: the `apt` module dearmors it into a keyring, and APT itself
+# verifies the InRelease signature against that keyring on `apt-get update`
+# - no `Trusted: yes` bypass involved.
 #
 # Built by tox-docker, whose build context is this directory (not the repo
 # root) - every COPY source below must live under tests/dockerfiles/repos/.
 FROM debian:trixie-slim AS packagebuild
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends dpkg-dev \
+    && apt-get install -y --no-install-recommends dpkg-dev apt-utils gnupg \
     && rm -rf /var/lib/apt/lists/*
 RUN set -eux; \
     pkg=idconfiguratortestpkg; \
@@ -18,6 +24,13 @@ RUN set -eux; \
 WORKDIR /srv
 RUN dpkg-scanpackages --multiversion . > Packages \
     && gzip -9c Packages > Packages.gz
+COPY apt-signing-key.key.asc /tmp/apt-signing-key.key.asc
+RUN gnupg_home="$(mktemp -d)" \
+    && gpg --homedir "$gnupg_home" --batch --import /tmp/apt-signing-key.key.asc \
+    && key_id="$(gpg --homedir "$gnupg_home" --list-secret-keys --with-colons | awk -F: '/^sec/{print $5; exit}')" \
+    && apt-ftparchive release . > Release \
+    && gpg --homedir "$gnupg_home" --batch --yes --pinentry-mode loopback --default-key "$key_id" --clearsign -o InRelease Release \
+    && rm -rf "$gnupg_home" /tmp/apt-signing-key.key.asc
 
 FROM nginx:alpine
 COPY --from=packagebuild /srv /srv