3 ms·

Putting the key in /etc/apt/trusted.gpg.d/ gives it too much power over all the repositories. A malicious (maybe compromised) third party repository could publi

• foresto 5y ago
  And while you're there, pay attention to the signed-by option. It's what allows you (the admin) to limit APT's trust in the keys you add.
• throw0101a 5y ago
  Actually it states: > The key MUST NOT be placed in /etc/apt/trusted.gpg.d or loaded by apt-key add. And yet the snippet that I quoted has the latter command. Further: the link has the example "[signed-by=/usr/share/keyrings/deriv-archive-keyring.gpg]". Perhaps it's my BSD upbringing showing through, but shouldn't only/mostly OS-provided stuff generally live in /usr/share? Shouldn't locally-added stuff go into /usr/local/share? Or perhaps creating a /etc/apt/local.gpg.d would be appropriate?
  • pabs3 5y ago
    The idea is you put the keyring into the same place where the -keyring package will be installed, so the -keyring package will overwrite it, so you don't then have a temporary keyring you downloaded with wget to delete, because it was overwritten by the -keyring package.
• pabs3 5y ago
  Unless you are auditing all third-party packages before installing them, any package can modify /etc/apt/trusted.gpg.d/ by dropping a file in there, or from its postinst/etc scripts at installation time etc. So using the signed-by mechanism isn't much of a security enhancement without the auditing.