If some attackers compromised an ISO image of Ubuntu and replaced inner PGP keys , then I will not to able get&install security updates. Is it right?
I'm asking it because I possible may meet the compromise OS and I heard that Ubuntu updates are PGP signed.
All updates in Ubuntu are signed and the signature is verified relatively to the PGP public keys install to that effect. A package won't be accepted as genuine unless its signature matches one of the keys. These keys are themselves installed and updated through the ubuntu-keyring and ubuntu-extras-keyring packages.
If an attacker manages to alter these packages on the ISO image that you use to bootstrap the whole process, then:
If the attacker removed or replaced the Ubuntu keys then your machine won't accept any extra packages, including updates, from the genuine Ubuntu servers.
If the attacker simply added his own public key but left the genuine keys in place, then updates will still work -- including a possible update to the ubuntu-keyring package, which may thus "kick out" the attacker by removing his extra key.
You are doomed anyway, because an attacker who could alter the ISO could have inserted backdoors in dozens of packages, keys or no keys.
