Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5926

Re: GPG verification of apt packages

From Ramin Doe <ramindough@gmail.com>
Newsgroups linux.debian.security
Subject Re: GPG verification of apt packages
Date 2021-02-01 20:00 +0100
Message-ID <BDMAy-2aH-3@gated-at.bofh.it> (permalink)
References <BBXJL-805-1@gated-at.bofh.it> <BC8c9-63y-1@gated-at.bofh.it> <BCjTY-4MQ-11@gated-at.bofh.it> <BClCp-5Cm-13@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

>
> >    This all sounds pretty promising! Thank you, Noah! Do you happen to
> know
> >    how to access this metadata? I'd love to be able to look at it and
> >    understand it better.
>
> See the signed InRelease files in /var/lib/apt/lists
>

Ah! I see some files here that are relevant to my search. Thanks! For
instance, on my system, I see a
mirrors.linode.com_debian_dists_buster_main_binary-amd64_Packages file that
contains a single SHA256 and a single MD5sum hash for each amd64 package. I
could see how that sort of information could be used to verify, on the fly,
the packages that arrive here.


> You should read
>
> https://www.debian.org/doc/manuals/securing-debian-manual/deb-pack-sign.en.html
>
> Thanks! I will do so!

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

GPG verification of apt packages Ramin Doe <ramindough@gmail.com> - 2021-01-27 19:30 +0100
  Re: GPG verification of apt packages Jonathan Hutchins <hutchins@tarcanfel.org> - 2021-01-27 20:20 +0100
  Re: GPG verification of apt packages Noah Meyerhans <noahm@debian.org> - 2021-01-28 06:40 +0100
    Re: GPG verification of apt packages Ramin Doe <ramindough@gmail.com> - 2021-01-28 19:10 +0100
      Re: GPG verification of apt packages Clément Hermann <nodens@debian.org> - 2021-01-28 20:50 +0100
      Re: GPG verification of apt packages Noah Meyerhans <noahm@debian.org> - 2021-01-28 21:00 +0100
        Re: GPG verification of apt packages Ramin Doe <ramindough@gmail.com> - 2021-02-01 20:00 +0100
        Re: GPG verification of apt packages Ramin Doe <ramindough@gmail.com> - 2021-02-03 22:00 +0100
          Re: GPG verification of apt packages Clément Hermann <nodens@nodens.org> - 2021-02-04 10:10 +0100

csiph-web