I'm asking myself the following question lately: How do you really know, that you've installed the package you ordered under debian/ubuntu with the use of APT?
I think I understood the basics of the verification chain -- except the very first link.
So when I tell apt to install a package, it downloads the
Release file from the repository-mirror specified in
sources.list. That file is signed by the repository maintainers secret key. Apt verifies the signature with the local trusted keys (
If everything is okay, apt uses the checksums in the "Release" file to verify further Packages files and the checksums in them to verify that the .deb files I'm installing have not been tampered with.
What I don't get at the moment is how do I verify that I've got a good set of trusted keys to verify the signature of the "release" file (ie. the first link in the chain).
In the common case I receive the keys via the
debian-archive-keyring packages or its ubuntu equivalent. But since my keyring is possibly empty at the beginning before installing it, i can't verify this package effectively. There has to be another option.
For debian, I have found this nice webpage https://ftp-master.debian.org/keys.html which I can access via HTTPS that lists all valid repository-maintainer keys. So I can use
apt-keyto verify the fingerprints of my local keys with those of the website. Seems good to me. But I can't find something similar for ubuntu. And this seems not to be the 'popular' method for verifying the keyring.
They even have this sentence on the page:
Please note that the details here are for information only, you should not rely on them and use other ways to verify them.
Via the Web of Trust. I've read some things about it, but I don't now if I'm convinced. eg.: When I search for the current debian-stable key on
pgp.mit.eduI see that the key is signed by four different keys. But I know none of them. To be fair, three of those four are heavily signed by a lot of people. But I don't know any of them either.
Wouldn't it be better if every 'repository creator' (like debian, ubuntu) had an easily and secure accessible https page where you can easily compare your local key to, instead of digging through the WOT in order to hopefully find a convincing link to the debian project?
Bonus question: Is there a possibility to 'verify', that a package is the result of a build process from a specific sourcecode you can look at?
So far I think, that the repository maintainer who signs the
release file 'promises' (don't know a better word) me this with his signature. Is that correct?