Often there is a need to use unofficial Linux software repositories (e.g. media codecs, wireless card drivers etc.) and hence the need to decide whether to trust them.

I am trying to figure out how much time I should be spending finding out about yet another repo that I consider using. How common is it for malicious Linux repos to pop up? Has it even ever happened?

1 Answer 1


Usually what is compromised is the mirror. So the original repo isn't malicious but the mirror on which it is being hosted on is.

That's why it's best to download with package manager so there's gpg signature check. If downloading manually, you can also sometimes verify checksums.

With gpg or checksums checking you are safe from compromised mirrors. The most dangerous thing to do is to download from some mirror without checking.

  • What about using a repo for the first time, when you are asked to trust its key? How do I know if the repo/mirror has been compromised or not?
    – Greendrake
    Commented Feb 20, 2018 at 9:57
  • 1
    Maybe you can verify the key on their website or on their main mirror
    – Aria
    Commented Feb 20, 2018 at 10:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .