Florian Kulzer wrote:
> On Sun, Jun 24, 2007 at 08:54:05 +0100, Chris Lale wrote:
>> Florian Kulzer wrote:
>> [...]
>>> An even better approach would be to download the Backports.org Archive
>>> Key manually and to check the signature before adding the new key to
>>> apt's keyring. (Installing the debian-backports-keyring package directly
>>> means that an unverified post-installation script has root on your
>>> computer, therefore you cannot really trust anything after that,
>>> including the keys on the Debian keyring.)
>>>
>>> P.S. The same goes for the debian-multimedia-keyring package.
>>>
>> Yes, Florian, you must be right! I wonder why they offer the keyring package?
>
> The keyring package allows automatic installation of new signing keys,
> just like debian-archive-keyring for the normal Debian pool. This is
> safe - or at least as "safe" as your basic trust in Debian is - provided
> that you perform the initial check. From the on, each new key can be
> verified (automatically) with the old key during a transition period and
> the chain of trust remains intact. (I don't know how often they will
> issue a new key for the backports archive, though; the normal Debian
> archive keys get updated at least once a year.)
>
>> The instructions page does give instructions about how to install the key -
>> and no mention of the debian-backports-keyring package:
>>
>> ... you can import backports.org archive’s key into apt:
>>
>> gpg --keyserver hkp://subkeys.pgp.net --recv-keys 16BA136C
>> gpg --export | apt-key add -
>>
>> or
>>
>> wget -O - http://backports.org/debian/archive.key | apt-key add -
>>
>> No mention of how to check it though. Can you check the sig before installing
>> the key?
>
> Yes, you can: Just run the "gpg ... --recv-keys ..." command as your
> normal user and the new key will be added (as untrusted) to your normal
> user's public keyring. Then you can perform the check:
>
> $ gpg --keyring /usr/share/keyrings/debian-keyring.gpg --check-sigs 16BA136C
>
> and make sure that Joerg Jaspert's signature (key 7E7B8AC9) is valid.
> After that you can feed the key to apt
>
> $ gpg -a --export 16BA136C | sudo apt-key add -
>
> and you are all set. If you do not want to use sudo then you can export
> the key to a file before you become root:
>
> $ gpg -a --export 16BA136C > backports-archive-key.txt
> # apt-key add backports-archive-key.txt
>
> If you have problems with the keyserver then you can use the wget
> command to add the key to your public keyring:
>
> $ wget -O - http://backports.org/debian/archive.key | gpg --import -
>
> Then you can perform the same check before you tell apt to trust the
> key. I would avoid running anything as root except for the apt-key
> command.
>
How to you check the output of "gpg --check-sigs"? I Googled a bit and it seems
that an exclamation mark ("!") indicates a successful check. Is that true?
eg
$ gpg --check-sigs --keyring /usr/share/keyrings/debian-backports-keyring.gpg
/usr/share/keyrings/debian-backports-keyring.gpg
------------------------------------------------
pub 1024D/16BA136C 2005-08-21
uid Backports.org Archive Key <[EMAIL PROTECTED]>
sig!3 16BA136C 2005-08-21 Backports.org Archive Key
<[EMAIL PROTECTED]>
sig!3 16BA136C 2005-08-21 Backports.org Archive Key
<[EMAIL PROTECTED]>
sub 2048g/5B82CECE 2005-08-21
sig! 16BA136C 2005-08-21 Backports.org Archive Key
<[EMAIL PROTECTED]>
I wanted to find a generic method of importing and checking keys for a number of
unofficial deb sites. It is difficult to find the key ids on some of the
websites. One thing they all had in common was having a keyring package. I tried
backports.org, debian-multimedia.org and debian-unofficial.org. So, here is my
generic method:
1. Add the appropriate line to /etc/apt/sources.list.
2. Update with apt-get or aptitude.
3. Install the appropriate keyring package (eg debian-multimedia-keyring). The
keyrings all end up in /etc/share/keyrings/${package-name}.gpg
4. Check the signatures IMMEDIATELY eg
$ gpg --check-sigs --keyring /usr/share/keyrings/debian-multimedia-keyring.gpg
5. If the check fails,
a.purge the keyring package and check that the keyring subdirectory has been
removed from /etc/share/keyrings/.
b. You can still install packages from the suspect repository, but there will be
a warning. To be safe, remove the repository line from /etc/apt/sources.list.
--
Chris.
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
