I often recompile packages from testing or unstable on stable, to get newer versions, or because I need to patch something. This is usually more productive than

I often recompile packages from testing or unstable on stable, to get newer versions, or because I need to patch something. This is usually more productive than installing from upstream source. (Exceptions are packages with a big tree of dependencies, where chances are high that something won't build.) More often than not, I'm checking the source package signautures (gpg) myself, though, because in the past doing it automatically wouldn't work or so. I wonder whether those signatures are concerned in this bug. I've tried to get at the source repo, but no luck (stable has a bzr repo that redirects to a 404, another url nearby does not contain recent changes; sid is in Git, but doesn't appear to have changes related to the bug). In the end I diffed the source of the apt package against its former version, I've put the diff here: http://christianjaeger.ch/scratch/apt-0.9.7.9+deb7u1_apt-0.9.7.9+deb7u2.diff http://christianjaeger.ch/scratch/apt-0.9.7.9+deb7u1_apt-0.9... I haven't studied it enough to get the answer (yet). Edit: it seems this really concerns repository signatures only, not package signatures; assuming that you're verifying that the package signature (the one in the *.dsc file) is correct and the hash sums match the package files, the only possible attack will be to refuse access to the correct/latest version of the package. Edit 2: but as the bug report points out, the .dsc signature check can't be relied on automatically (even if the check fails, apt returns success, you have to read the stdout/stderr instead). https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749795 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749795 So the only way to have been safe was to check every apt-source'd package individually, with manual eyeing or running of gpg. And, this bit (from the bug report) may be most worrysome: "(..) all debian build systems which probably rely on secure APT." (i.e. the binary packages may have been built automatically based on source that was fetched without protection).