Re: GPG verification of apt packages

From	Clément Hermann <nodens@nodens.org>
Newsgroups	linux.debian.security
Subject	Re: GPG verification of apt packages
Date	2021-02-04 10:10 +0100
Message-ID	<BEIOd-3Rp-3@gated-at.bofh.it> (permalink)
References	<BBXJL-805-1@gated-at.bofh.it> <BC8c9-63y-1@gated-at.bofh.it> <BCjTY-4MQ-11@gated-at.bofh.it> <BClCp-5Cm-13@gated-at.bofh.it> <BExpL-59a-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 03/02/2021 21:50, Ramin Doe wrote:
> It's not entirely clear to me what the CIS guideline was expecting me to
> do. It says:
> 
>     Verify GPG keys are configured correctly for your package manager:
>     # apt-key list
> 
> Perhaps they want me to install apt-key, and use it to look at the gpg
> keys installed on my system, and then somehow verify that they aren't
> compromised? Does that sound like I'm understanding them correctly?

apt-key is considered deprecated (check the man: apt-key(8)). However,
what this command does is show you the list of keys trusted for package
installation.

I guess it's to make sure you have only legit keys there - but I didn't
read those guidelines, so I can't be completely sure :)

Cheers,

-- 
nodens

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

GPG verification of apt packages Ramin Doe <ramindough@gmail.com> - 2021-01-27 19:30 +0100
  Re: GPG verification of apt packages Jonathan Hutchins <hutchins@tarcanfel.org> - 2021-01-27 20:20 +0100
  Re: GPG verification of apt packages Noah Meyerhans <noahm@debian.org> - 2021-01-28 06:40 +0100
    Re: GPG verification of apt packages Ramin Doe <ramindough@gmail.com> - 2021-01-28 19:10 +0100
      Re: GPG verification of apt packages Clément Hermann <nodens@debian.org> - 2021-01-28 20:50 +0100
      Re: GPG verification of apt packages Noah Meyerhans <noahm@debian.org> - 2021-01-28 21:00 +0100
        Re: GPG verification of apt packages Ramin Doe <ramindough@gmail.com> - 2021-02-01 20:00 +0100
        Re: GPG verification of apt packages Ramin Doe <ramindough@gmail.com> - 2021-02-03 22:00 +0100
          Re: GPG verification of apt packages Clément Hermann <nodens@nodens.org> - 2021-02-04 10:10 +0100

csiph-web