Often there is a need to use unofficial Linux software repositories (e.g. media codecs, wireless card drivers etc.) and hence the need to decide whether to trust them.

I am trying to figure out how much time I should be spending finding out about yet another repo that I consider using. How common is it for malicious Linux repos to pop up? Has it even ever happened?


Usually what is compromised is the mirror. So the original repo isn't malicious but the mirror on which it is being hosted on is.

That's why it's best to download with package manager so there's gpg signature check. If downloading manually, you can also sometimes verify checksums.

With gpg or checksums checking you are safe from compromised mirrors. The most dangerous thing to do is to download from some mirror without checking.

| improve this answer | |
  • What about using a repo for the first time, when you are asked to trust its key? How do I know if the repo/mirror has been compromised or not? – Greendrake Feb 20 '18 at 9:57
  • 1
    Maybe you can verify the key on their website or on their main mirror – Aria Feb 20 '18 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.