4 ms·

Read 'em and weep: https://blog.packagecloud.io/eng/2018/02/21/attacks-against-secure-apt-repositories/ https://blog.packagecloud.io/eng/2018/02/21/attacks-aga

Read 'em and weep: https://blog.packagecloud.io/eng/2018/02/21/attacks-against-secure-apt-repositories/ https://blog.packagecloud.io/eng/2018/02/21/attacks-against-... https://isis.poly.edu/~jcappos/papers/cappos_mirror_ccs_08.pdf https://isis.poly.edu/~jcappos/papers/cappos_mirror_ccs_08.p... "GPG signing a Debian package does nothing because package signatures are not verified by default on any major distribution when packages are installed with apt-get install. See your /etc/dpkg/dpkg.cfg file for an explicit comment to this effect." And: "When APT software (such as apt-get, or reprepro) or folks offering APT repositories mention GPG signatures in their documentation they are typically referring to GPG signatures on repository metadata, not on packages themselves. Likewise, when you configure the SignWith option of reprepro (documented here), you are telling reprepro to sign your repository metadata with the specified GPG key; this does not sign any of the packages, though."

lamby 8y ago
> GPG signing a Debian package does nothing because package signatures are not verified by default on any major distribution when packages are installed with apt-get install That's sliiiiiiightly misleading. :/
- xenophonf 8y ago
  On both Debian 9.4 and Ubuntu 16.04 (what I have handy): # Do not enable debsig-verify by default; since the distribution is not using # embedded signatures, debsig-verify would reject all packages. no-debsig
dmm 8y ago
> If the repository is served ... with Acquire::AllowDowngradeToInsecureRepositories set to true(the default is false, thankfully) So you're saying if I explicitly disable an important security feature my system is less secure? No tears yet... That's a good article. It has information relevant to groups setting up apt repositories but the only issue that potentially applies to using the official Debian repositories is the replay attack and that would work even if you were verifying the signatures of individual packages.

lamby 8y ago

> GPG signing a Debian package does nothing because package signatures are not verified by default on any major distribution when packages are installed with apt-get install That's sliiiiiiightly misleading. :/

xenophonf 8y ago
On both Debian 9.4 and Ubuntu 16.04 (what I have handy): # Do not enable debsig-verify by default; since the distribution is not using # embedded signatures, debsig-verify would reject all packages. no-debsig

dmm 8y ago

> If the repository is served ... with Acquire::AllowDowngradeToInsecureRepositories set to true(the default is false, thankfully) So you're saying if I explicitly disable an important security feature my system is less secure? No tears yet... That's a good article. It has information relevant to groups setting up apt repositories but the only issue that potentially applies to using the official Debian repositories is the replay attack and that would work even if you were verifying the signatures of individual packages.