Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5924

Re: GPG verification of apt packages

Show all headers | View raw

Hi,

On 28/01/2021 19:08, Ramin Doe wrote:

> "Currently there are two different implementations for signing
> individual packages..."
> I think this is referring to the GPG signature verification mechanisms
> that are disabled by default. I'm happy to not try to not go down the
> route of enabling GPG verification, since it seems to be poorly
> documented (I haven't found a single concrete example of how to do
> this), so long as I can feel that the metadata checksum method is
> sufficiently reliable. I think that looking at the Release files would
> go a long way to relieving my anxiety about this. Any help would be
> appreciated!

Check any mirror ? e.g https://debian.ethz.ch/debian/dists/buster/

> I do wish there was an official document giving a high-level TLDR
> description of apt security, complete with caveats. As a bonus
> cherry-on-top wish, it would be awesome if it furthermore made clear
> what old mechanisms were deprecated and could be ignored!

The closest thing that comes to my mind would be
https://www.debian.org/doc/manuals/securing-debian-manual/deb-pack-sign.en.html.
Hope it helps!

Cheers,

-- 
nodens

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

GPG verification of apt packages Ramin Doe <ramindough@gmail.com> - 2021-01-27 19:30 +0100
  Re: GPG verification of apt packages Jonathan Hutchins <hutchins@tarcanfel.org> - 2021-01-27 20:20 +0100
  Re: GPG verification of apt packages Noah Meyerhans <noahm@debian.org> - 2021-01-28 06:40 +0100
    Re: GPG verification of apt packages Ramin Doe <ramindough@gmail.com> - 2021-01-28 19:10 +0100
      Re: GPG verification of apt packages Clément Hermann <nodens@debian.org> - 2021-01-28 20:50 +0100
      Re: GPG verification of apt packages Noah Meyerhans <noahm@debian.org> - 2021-01-28 21:00 +0100
        Re: GPG verification of apt packages Ramin Doe <ramindough@gmail.com> - 2021-02-01 20:00 +0100
        Re: GPG verification of apt packages Ramin Doe <ramindough@gmail.com> - 2021-02-03 22:00 +0100
          Re: GPG verification of apt packages Clément Hermann <nodens@nodens.org> - 2021-02-04 10:10 +0100

csiph-web