8

When I'm using the Linux software PackageKit, I get confused about what specific items of information I will need in order to decide whether to authorize software installation from a new software source.

I'm using Gnome in openSUSE. I think the question would be just the same for other systems that have PackageKit, such as KDE in Fedora.

Each time that I do this, I wonder:

  • What opinions do I need to form?
  • What values do I need to know in order to form my opinions?
  • How do I determine that those values are correct and consistent?

Several times I have elected to install software from a repository that wasn't previously configured in Linux. A repository can give me advantages including notifications of updates and better integration with my distribution and environment.

Soon after I choose to install the new software, often by pushing a 1-click install button on the software.opensuse.org web site, the PackageKit "Software signature is required" dialog appears. It displays the following items of information. Each of them seems to relate to something that I may need, but they each present a bit of a puzzle as well.

  • Repository name. This is often one word. I think it is not always exactly the same text as what I would see listed at software.opensuse.org, or wherever I last saw mention of the repository. Anyway I'm not sure where PackageKit gets this name and on what basis I can believe it's correct.
  • Signature URL. I don't know what to do with it. I suspect it's the ID of some resource, not actually a site where I can learn more.
  • Signature user identifier. I don't know what to do with this, either. It looks like an email address. I don't know whether it represents the person I should trust, the person I should contact with concerns, the address at which I should contact that person, etc.
  • Signature identifier, eight hexadecimal digits. It's not quite clear from the dialog or its documentation, but I gather that it's actually just a few digits of a GPG key that in full would have 40 hexadecimal digits.

There has been criticism of the "Software signature is required" dialog. That's not exactly what I'm looking for. If needed, I could avoid PackageKit for this task and use YaST or zypper, just as PackageKit users on other systems could use apt, dpkg, rpm, or yum. I would still want to know what information is necessary, whether it's the information that PackageKit presents or any other information.

Improve this question
0

2 Answers 2

Reset to default
4
+50

This is why the dialog sucks: it's confusing.

The decision to trust a particular repository or not is one you already took when you added it to your package manager. The whole point is to get software from the repo: if you didn't trust it you wouldn't be downloading and running code from it.

I suspect that this dialog is attempting to protect you from a situation where the repository is not the same one you trusted when you added it. For example, someone might have performed a Man-In-The-Middle attack, so you think PackageKit is connecting to the trusted repo but in fact is connecting to another, evil one. If it's connecting to the evil one, then the signature will not match.

If that's right, then they certainly shouldn't show it to you very often. They should trust the repo's signature at the point of adding it, and then pop up this dialog only when there's subsequent trouble.

Improve this answer
1
  • Agreed. I might add that some distros just say 'requires software from unsigned sources' when the gpg key is not already imported or the software is unsigned. A much better idea.
    – RobotHumans
    Mar 9, 2012 at 2:44
0

The linked forum discussion may be part of the answer. Others helping to answer this question should please feel free to draw on that source and this summary of it.

The discussion gives an example of a successful check on PackageKit's dialog "Software signature is required". The procedure was supposedly obvious to the participants in that discussion, but I was not familiar with it and possibly many other PackageKit users are not either.

In Fedora 15, a user was presented the "Software signature is required" dialog including the following values:

  • Signature URL: /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-x86_64
  • Signature user identifier: Fedora (15)
  • Signature identifier: 069C8460
  • Package: libid3tag-0.15.1b-11.fc15.x86_64

From there the user's procedure was, or at least could have been, as follows.

  1. Browse one of the cryptographic key servers that one may find mentioned, for example, by way of Wikipedia article "Key server (cryptographic)": http://pgp.mit.edu/
  2. Search that server for the email address from the signature user identifier in the dialog: [email protected]
  3. Within the result page, use the browser's Find command to find the signature identifier: 069C8460
  4. Click the link on that identifier to view the PGP public key block.
  5. Do something or compare something with the PGP public key block... well, I don't know yet, but one needs to know the specifics here in order to get the available assurances about security.

This procedure effectively assured the user of the following relevant facts:

  • ... well, I haven't exactly worked them out yet, but one would need to understand what facts are justified by that procedure in order to apply the same general procedure to other specific cases.
Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .