Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #6452 > unrolled thread

Why Does Debian Use PGP to Sign Packages

Back to article view | Back to linux.debian.security

Contents

  Why Does Debian Use PGP to Sign Packages fosres@posteo.de - 2025-08-16 03:40 +0200
    Re: Why Does Debian Use PGP to Sign Packages Jeffrey Walton <noloader@gmail.com> - 2025-08-16 11:20 +0200
      Re: Why Does Debian Use PGP to Sign Packages Simon Josefsson <simon@josefsson.org> - 2025-08-16 11:40 +0200
    Re: Why Does Debian Use PGP to Sign Packages Simon Josefsson <simon@josefsson.org> - 2025-08-16 11:30 +0200
    Re: Why Does Debian Use PGP to Sign Packages kpcyrd <kpcyrd@archlinux.org> - 2025-08-16 16:30 +0200

#6452 — Why Does Debian Use PGP to Sign Packages

Hello All,

In an earlier post I asked why Debian uses PGP to sign packages despite 
its complexity.

Some responded that Sequoia PGP simplifies the process.

I now wish to ask why Debian uses PGP in general to sign packages when 
there are alternatives such as SigStore.

What were the unique benefits in PGP that could not be found in other 
alternatives?

I thank all in advance for any responses.

Best,

Tanveer Salim

[toc] | [next] | [standalone]

#6453

[Multipart message — attachments visible in raw view] — view raw

On Sat, Aug 16, 2025 at 12:45 AM <fosres@posteo.de> wrote:

> Hello All,
>
> In an earlier post I asked why Debian uses PGP to sign packages despite
> its complexity.
>
> Some responded that Sequoia PGP simplifies the process.
>
> I now wish to ask why Debian uses PGP in general to sign packages when
> there are alternatives such as SigStore.
>
> What were the unique benefits in PGP that could not be found in other
> alternatives?
>
> I thank all in advance for any responses.
>

Also see <
https://www.debian.org/doc/manuals/securing-debian-manual/deb-pack-sign.en.html
>.

Jeff

[toc] | [prev] | [next] | [standalone]

#6455

[Multipart message — attachments visible in raw view] — view raw

Jeffrey Walton <noloader@gmail.com> writes:

> https://www.debian.org/doc/manuals/securing-debian-manual/deb-pack-sign.en.html

That's all MD5.  Looks like that document hasn't been updated for the
last decade or so.

"The Release files also include SHA-1 checksums, which will be useful
once MD5 sums become fully broken, however apt doesn't use them yet."

Today both MD5 and SHA1 are fully broken...

/Simon

[toc] | [prev] | [next] | [standalone]

#6454

[Multipart message — attachments visible in raw view] — view raw

fosres@posteo.de writes:

> Hello All,
>
> In an earlier post I asked why Debian uses PGP to sign packages
> despite its complexity.
>
> Some responded that Sequoia PGP simplifies the process.
>
> I now wish to ask why Debian uses PGP in general to sign packages when
> there are alternatives such as SigStore.
>
> What were the unique benefits in PGP that could not be found in other
> alternatives?

It existed.  Sigstore or other alternatives didn't, at the time.
Sigstore and other transparency logs like Sigsum offers better security
claims than PGP ever has, protecting against hidden releases.  I wish
there were pure C and Python verifiers available for Sigstore and Sigsum
to further ease of use of these technologies.

/Simon

[toc] | [prev] | [next] | [standalone]

#6456

On 8/16/25 3:22 AM, fosres@posteo.de wrote:
> Hello All,
> 
> In an earlier post I asked why Debian uses PGP to sign packages despite 
> its complexity.
> 
> Some responded that Sequoia PGP simplifies the process.
> 
> I now wish to ask why Debian uses PGP in general to sign packages when 
> there are alternatives such as SigStore.

Having worked with both PGP/RFC-4880 and Sigstore, I found them to be of 
similar complexity, implementation wise (x509, ASN.1, base64 encoded 
json all layered into each other, some multiple times).

Also, when I looked into pypi's implementation of PEP-740[1], I couldn't 
figure out how to do an offline-verification of the 
signature/attestation using the sigstore Rust crate[2], to the point I 
gave up on my project.

[1]: https://github.com/kpcyrd/pypi-provenance-auth
[2]: https://docs.rs/sigstore/

(Not trying to hijack this thread, but if somebody knows how to do this, 
I'm still interested in a solution).

cheers,
kpcyrd

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web