Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #196400

Re: .deb packages and security

Show all headers | View raw

On 6/4/2018 3:09 PM, Dan Purgert wrote:
> Anil Duggirala wrote:
>> hello,
>> I know installing .deb packages downloaded from websites is not a good
>> practice in terms of software management in Debian. I would like to
>> know if I should have security concerns when installing a .deb package
>> "manually" (using gdebi for example) ?
> 
> Do you trust the provider of the *deb package?  If so, you should be
> fine.  If you want to take it a step farther, see if there's a (sha256)
> checksum for the package.
> 

Note that checksum (sha512) and key verification are two separate things:

- checksum will insure that the file is not corrupted
- key verification will insure that the file has not been tempered with

So both steps is a must!

-- 
John Doe

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

.deb packages and security Anil Duggirala <anilduggirala@fastmail.fm> - 2018-06-04 14:30 +0200
  Re: .deb packages and security <tomas@tuxteam.de> - 2018-06-04 15:10 +0200
  Re: .deb packages and security Dan Purgert <dan@djph.net> - 2018-06-04 15:20 +0200
    Re: .deb packages and security john doe <johndoe65534@mail.com> - 2018-06-04 15:40 +0200
      Re: .deb packages and security Darac Marjal <mailinglist@darac.org.uk> - 2018-06-04 15:50 +0200

csiph-web