diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2b156e63..25412e6c 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -52,7 +52,7 @@ SET(CPACK_DEBIAN_PACKAGE_RECOMMENDS "fuse")
 
 SET(CPACK_DEBIAN_PACKAGE_HOMEPAGE "http://cryfs.org")
 SET(CPACK_RPM_PACKAGE_LICENSE "LGPLv3")
-
+SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/debfiles/postinst;${CMAKE_CURRENT_SOURCE_DIR}/debfiles/postrm")
 
 INCLUDE(CPack)
 
diff --git a/debfiles/postinst b/debfiles/postinst
new file mode 100755
index 00000000..276c4182
--- /dev/null
+++ b/debfiles/postinst
@@ -0,0 +1,135 @@
+#!/bin/bash
+# This script is called after the cryfs .deb package is installed.
+# It sets up the package source so the user gets automatic updates for cryfs.
+
+# DEVELOPER WARNING: There is a lot of redundancy between this file and the install.sh script in the cryfs-web repository. Please port modifications to there!
+
+set -e
+
+DEBIAN_VERSIONS="jessie"
+UBUNTU_VERSIONS="precise trusty vivid wily"
+
+DEBIAN_REPO_URL="http://apt.cryfs.org/debian"
+UBUNTU_REPO_URL="http://apt.cryfs.org/ubuntu"
+
+DISTRIBUTION=`lsb_release -s -i`
+DISTRIBUTION_VERSION=`lsb_release -s -c`
+
+containsElement () {
+  local e
+  for e in "${@:2}"; do  [[ "$e" == "$1" ]] && return 0; done
+  return 1
+}
+
+get_repo_url () {
+  if [[ "$DISTRIBUTION" == "Debian" ]]; then
+    if ! containsElement $DISTRIBUTION_VERSION $DEBIAN_VERSIONS; then
+      echo Unsupported Debian Version: $DISTRIBUTION_VERSION 1>&2
+      exit 1
+    fi
+    echo $DEBIAN_REPO_URL
+  elif [[ "$DISTRIBUTION" == "Ubuntu" ]]; then
+    if ! containsElement $DISTRIBUTION_VERSION $UBUNTU_VERSIONS; then
+      echo Unsupported Ubuntu Version: $DISTRIBUTION_VERSION 1>&2
+      exit 1
+    fi
+    echo $UBUNTU_REPO_URL
+  else
+    echo Unsupported Operating System: $DISTRIBUTION 1>&2
+    exit 1
+  fi
+}
+
+get_apt_config () {
+  apt-config dump|grep "$1 "|sed -e "s/^$1\ \"\([^\"]*\)\"\;/\1/g"
+}
+
+sources_list_dir () {
+  root=$(get_apt_config "Dir")
+  etc=$(get_apt_config "Dir::Etc")
+  sourceparts=$(get_apt_config "Dir::Etc::sourceparts")
+  echo $root$etc$sourceparts
+}
+
+add_repository () {
+  dir=$(sources_list_dir)
+  repo_url=$(get_repo_url)
+  echo "deb $repo_url $DISTRIBUTION_VERSION main" > $dir/cryfs.list
+}
+
+install_key () {
+  # Key from http://www.cryfs.org/apt.key
+  apt-key add - > /dev/null <<KEYEND
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQINBFZxifMBEAC/KdA6/pf+0P7CMFPPxEPi9bVe8blG0xwMiFVeq9QOPYIjGsoO
+vE/KsvqAN6ig1mMBfD7K9l2CZLX2srzSD3vHSg7btqciRVzKyEVasoNllKmqm8//
+3UvYpqWL1mZkxtey5aSlcYxUo7+TyUK76hLjEiuT55ZHJeg9WZGWyoBzniRJ1zbl
+FjYc44+5o1ec7lfEzIClU+IRw0t69j1x3BbClM57JSgmFu2f0cGwGXKYqHVMXIY/
+qflD3AkY+eokKXWoxg6V8LiyHMy0MArpaMpKTwSQ6gCy6EnPmiH3xuckkSXtWcjm
+hYCZZZ7LHY9UQymYweaLnJLUX/9TB5P7kN+mH1Gyh/A5HJZ9WKtL18GK/+iHMxSP
+Ma1g9kniAqZYbsynxgcyM0YuxrQ1wPA4+Z89Z5E9os6Jlo7CcMq8YUQKZd+/3B1o
+BP0vplSnQRJyWHS8Gfoovmxsfwe29eUIlfo7hbTRo/F7BZRZoTDJH2Agn4HX2Uj+
+hZUqlu/enB2KGNMBZpzLyLPi6oTBPQTmdyGjgEEvxgry+3QAlvbUYMrDkScyY9HX
+8VlUeA7qkEQzCqE0ometqO0VpGnvk+fu625G0jVz1z4DdroPBaMLhqKmo4lTVXtI
+f4U1LZqYS1oQj1Nw/tZefOSNuz4w1+K6xBT2ChVxRZzD41rcTkT28XR6CwARAQAB
+tB5DcnlGUyBUZWFtIDxtZXNzbWVyQGNyeWZzLm9yZz6JAj4EEwECACgFAlZxifMC
+GwMFCQeEzgAGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEAF9yTJUnmWycBUP
+/RE/HeFIXhl974XhdvNk8u5TBIleYYksyNDDJa/Wij1X4x9UbS7KT4dnwr0jY0pT
+zi2brSsPqyZiO77lNxyOR6r8klL76rQiOg3gCnZyClwOMxpT7/RBTGEUBRWuI4KQ
+dewSpK+g09dpokuewjuVI0mg62PPI+ddeLfs5NTLT2dN21ZFNGPYsWPtnTcPwkBw
+rbPkQ5yUpY0NXexilq7UzicEF31vCrar05RW81Oj3XjnjO4cTSqIRqbcRIrkZHSA
+UC+hltwxh0L9QTrqlEZ2FNC3cy9SsCrU1sq6hh+9tEjlKQLS9EMOLKl9T4Bg/Bjj
+u2Ksk6W3ZletDBoZNoI1r8dPbKIiYBimoGOcNi/CKG4yeS3LRMceVYraLgAeU6BU
+aKdTUOMLm5Z84KZ1/WWkKH0VnpnZ+BD8VQ+uriDvFk/KAcLHc1BMf0IgBm3/WBOO
+YncYH7mECkvD7PpNzh5n6cfotcc2ciZaOrYp5MHcGRGKvFOIfefuUcWf2fakFHSH
+Hy/HWW/t0HFqvKOrwqrDyxhm3Hh3dwFHuma3nlSsg+L2WhqwnSodAqUsrlawdHwz
+8FM+4kXQPUxYJQI3Y4jjU3nd/noUhsZk2ZTMM8YgdrqN1bu4G/Q2KKrfaTq0SxDI
+m7JCCcYzS9cZiGYklYjruPo9OClJJ8FJWdlgDyDkua9SuQINBFZxifMBEADFUvQB
+FCPLEpQyz/4GMXDRpi/LGnGdkDT8huhvCHOAPAY+FGBgTpE60F8jXRO43woG212L
+A6+EuLGdvkR3vZNTIrYR2CQPdpHNVrSHAumhE0eRTeb0Cao068Ryc/vfVyOVKuOz
+UDRi1VdBFBtsM2Zv0Se581t+C7X2x9LMNVTyal+cMKHUM2/2dtXoU/LkJJieop9s
+Pv3oIBfCclxuK2O+gFi4ktW+nBoYQmSdWhUA5vZGy/g8+v42PZyG+VK9N+XFYm8B
+NmUu8WsLIS3dkxgIUQ/agUHIo9NRGwpMEMYCh7Ene2/8xpP6JlrSYTFxeUedG4BU
+X0zngno+l9X9ehYqkrb7QpxZnDVlD9LhTO+aX8pxiAPDbnqr4tqp9Q10TStxuOJA
+JG4nwjSYlLxIFhAey91fYvS0r8M4/f1SQKBz/4X/DJdZUFJLQZc5sjwmtBXnmLTt
+wokuX0Ecnif2pnN1Z3DEvUgL9j85M15BQk8F3aLOA35HgoF25W8AVRX9TI61uk9P
+yDIkyqLI0W7LFIFEtuNL/pJ4aPCJo2H9e8Cvd8DDZpIhtnskncwly9asPmxQANAs
+rNViEOOKi/DYTXxpOF7qW//gSmp6E930QWo8GS4eobTw177dh3c0f2EkRIHTO/F8
+7Q2sIh1SiC4mly3s3cmNtoICbc6L9we40rIE+wARAQABiQIlBBgBAgAPBQJWcYnz
+AhsMBQkHhM4AAAoJEAF9yTJUnmWy4coQAI746UpKJAliqVmdUVwAiTadR3vz0Gyq
+E/HLqi6Q73pdJcMJ11ml9ZDJn/QOFi9l8V93YLLBxVx5i0RQMHQNtj2dGg1LYgVR
+VZLzfvBhJkh1/uulaYWh4CYGTvLVf8Oihl/PIAonrweDQdXZCG6VvkxFx46/sCPg
+oeO8NGKkrNFbA7ztQElqWkTuQs1tMgWvylCng2BrltPGKHqnAiYM1qAp2YdD+k9v
+kd3Ppd9AfgaCg5T5Mks+rNMeDfprcC6FdiaJBV0QXasfSVCv5ph/YwRbrkM+tKAW
+H9K51Myi7J9k5sIhsA1h6Bx3cjbNES4cnYUJEC2z6JmITzHP0uBWMwNoy9nykWpK
+qswsGo4iD0syLOCkDIr2h0NKcCf0D20HPT8javVWz9cBfcKcXlSdO2Ju8+ONCrBe
+ydEBA91yqM8k89fDUyhXI+e7hueUDZ+KUHC87wys82XyGQ/++AiPec3TTYVL2fiN
+Q3mgKsOK0D/WziJdtL1i15CDUjhg0fUq4jNeHVnq7LUb/CmG7MB3jPI/jD+/pxGV
+cGZtlxRJvXCjpaGJL0+AV0wE4rmkrpSAVC/9AeDi3l+tohUYB2WKOkXZEo90ShS2
+cwOccYvBiIYhNMbgr5qsqPEJhcfdwXUpgJjZgFn9Y8ZwIJgjCEZllU2iEMKtbqwv
+2oSFOf0c0GiV
+=l3s3
+-----END PGP PUBLIC KEY BLOCK-----
+KEYEND
+}
+
+case "$1" in
+    configure)
+        install_key
+        add_repository
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument '$1'" >&2
+        exit 1
+    ;;
+esac
+
+set +e
+
+exit 0
diff --git a/debfiles/postrm b/debfiles/postrm
new file mode 100755
index 00000000..ac097bba
--- /dev/null
+++ b/debfiles/postrm
@@ -0,0 +1,45 @@
+#!/bin/bash
+# This script is called after the cryfs .deb package is uninstalled.
+# It removes the package source that was used to get automatic updates.
+
+set -e
+
+get_apt_config () {
+  apt-config dump|grep "$1 "|sed -e "s/^$1\ \"\([^\"]*\)\"\;/\1/g"
+}
+
+sources_list_dir () {
+  root=$(get_apt_config "Dir")
+  etc=$(get_apt_config "Dir::Etc")
+  sourceparts=$(get_apt_config "Dir::Etc::sourceparts")
+  echo $root$etc$sourceparts
+}
+
+remove_repository () {
+  dir=$(sources_list_dir)
+  rm -f $dir/cryfs.list
+}
+
+remove_key () {
+  # Don't fail if key was already removed
+  apt-key rm 549E65B2 2>&1 > /dev/null || true
+}
+
+case "$1" in
+    purge)
+        remove_repository
+        remove_key
+    ;;
+
+    abort-install|abort-upgrade|remove|upgrade|failed-upgrade)
+    ;;
+
+    *)
+        echo "postrm called with unknown argument '$1'" >&2
+        exit 1
+    ;;
+esac
+
+set +e
+
+exit 0
diff --git a/src/cli/Cli.cpp b/src/cli/Cli.cpp
index be5ee85b..0604530b 100644
--- a/src/cli/Cli.cpp
+++ b/src/cli/Cli.cpp
@@ -28,6 +28,7 @@
 #error The used libc implementation has a maximal password size for getpass(). We cannot use it to ask for passwords.
 #endif
 
+//TODO Fails with gpg-homedir in filesystem: gpg --homedir gpg-homedir --gen-key
 //TODO Many functions accessing the ProgramOptions object. Factor out into class that stores it as a member.
 //TODO Factor out class handling askPassword