Unit 10: Packages, signatures and patching · Lesson 2 of 5 · 20 min

Signed repositories

apt refuses packages whose index is not signed by a key you trust. See the signature work and fail.

mission

You are
You are checking that web01 only accepts signed packages.
Situation
A copy of the company repository's index and a tampered version of it are in /srv/cases/mirror-check.
Goal
Find the trusted key, verify the real index and watch the tampered one fail.
Hand in
The key fingerprint and both verification results.

The chain of trust

  1. Signing keyHeld by the packaging team
  2. ReleaseSigned list of index hashes
  3. PackagesHash of every .deb
  4. The .debChecked against Packages before install
01

Which key does the source trust?

learner@root-lab
cat /etc/apt/sources.list.d/shop.sources
Types: deb
URIs: file:/srv/mirror
Suites: stable
Components: main
Signed-By: /usr/share/keyrings/shop-archive.gpg
gpg --show-keys /usr/share/keyrings/shop-archive.gpg 2>/dev/null
pub   ed25519 2026-01-05 [SC]
      9C760D196A191910AE3B5529D4DD2E411DBCCD5F
uid                      Shop Example Packages <packages@shop.example>

you should see Signed-By pins this repository to one key.

02

Verify the real index

learner@root-lab
gpgv --keyring /usr/share/keyrings/shop-archive.gpg Release.gpg Release
gpgv: Signature made Tue Oct 20 02:00:00 2026 UTC
gpgv:                using EDDSA key 9C760D196A191910AE3B5529D4DD2E411DBCCD5F
gpgv: Good signature from "Shop Example Packages <packages@shop.example>"

you should see Good signature.

03

Verify the tampered one

learner@root-lab
gpgv --keyring /usr/share/keyrings/shop-archive.gpg Release.gpg Release.modified
gpgv: Signature made Tue Oct 20 02:00:00 2026 UTC
gpgv:                using EDDSA key 9C760D196A191910AE3B5529D4DD2E411DBCCD5F
gpgv: BAD signature from "Shop Example Packages <packages@shop.example>"
diff Release Release.modified
15c15
<  aa2f9ba7309298c316afed623af2878ede259c50e62f9c4e351c62f1a6002657             1783 main/binary-amd64/Packages
---
>  0000000000000000000000000000000000000000000000000000000000000000             1783 main/binary-amd64/Packages

you should see BAD signature. One hash changed and the whole file is rejected.

04

Follow one hash down

learner@root-lab
grep 'binary-amd64/Packages$' Release | tail -n 1
 9725d66e4b36a9ec37325bfa12c84a39c305500e8b2340770e4389babdbc618e61a088fa6622dd7d4c3e93234fc7bba224c8a560c4d4c3170594dfec22fb38d7             1783 main/binary-amd64/Packages
sha256sum /srv/mirror/dists/stable/main/binary-amd64/Packages
aa2f9ba7309298c316afed623af2878ede259c50e62f9c4e351c62f1a6002657  /srv/mirror/dists/stable/main/binary-amd64/Packages

you should see The signed Release vouches for the exact Packages file.

defender tip Never add [trusted=yes] or a key to the global keyring to make an error go away. Pin each repository to its own key with Signed-By.

Adding a repository

Trust everything
deb [trusted=yes] http://mirror.example/ stable main

Anyone in the path can serve packages

Pinned key
Types: deb
URIs: file:/srv/mirror
Signed-By: /usr/share/keyrings/shop-archive.gpg

Only this key can vouch for this repository

What a defender takes away

  1. 1Signatures prove who published an index.
  2. 2Hashes chain the signature down to every package.
  3. 3Pin each repository to its own key.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.