How verification works ?
A
distribution
source
, the location from which we are going to download its release file ,
can either be located in
the file
/etc/apt/sources.list
or
in the directory
/etc/apt/sources.list.d/
.
# example of the content of /etc/apt/sources.list # buster distribution # main component # authored by the debian project deb http://deb.debian.org/debian/ buster main deb-src http://deb.debian.org/debian/ buster main # buster distribution # security updates # main component # authored by the debian project security team deb http://security.debian.org/debian-security buster/updates main deb-src http://security.debian.org/debian-security buster/updates main # buster-updates distribution extension # main component # authored by the debian project deb http://deb.debian.org/debian/ buster-updates main deb-src http://deb.debian.org/debian/ buster-updates main # buster distribution # main component # authored by winehq deb https://dl.winehq.org/wine-builds/debian/ buster main # stable distribution # main component # authored by microsoft deb https://packages.microsoft.com/repos/vscode stable main
The
public keys used to verify a
distribution
release file can be located either
in the
/etc/apt/trusted.gpg.d/
directory on in the
/etc/apt/trusted.gpg
file .
# example of the content of /etc/apt/trusted.gpg.d # directory. @debian:/etc/apt/trusted.gpg.d$ ls # list the content of /etc/apt/trusted.gpg.d/ debian-archive-buster-automatic.gpg # Public key installed by the # debian-archive-keyring package . It can # be used to verify the signature of the # distribution or the distribution extensions # authored by the debian project and which have # a code name that starts with buster . debian-archive-buster-security-automatic.gpg # Public key installed by the # debian-archive-keyring package . It can be # used to verify the signature of the # distribution with a code name of buster # authored by the debian project security team . debian-archive-buster-stable.gpg # Public key installed by the # debian-archive-keyring package . It can be # used to verify the signature of the # distribution with a code name of # buster authored by the debian # project.
When debian is installed , the package debian-archive-keyring is also installed . This package contains public keys which can be used to verify the release files of distributions authored by the debian project .
If
the
apt-get update
command is issued,
using the previous
/etc/apt/sources.list
file , and the public keys in the
/etc/apt/trusted.gpg.d
directory
, then the result will be :
@debian:~$ apt-get update Hit:1 http://deb.debian.org/debian buster InRelease Hit:2 http://security.debian.org/debian-security buster/updates InRelease Hit:3 http://deb.debian.org/debian buster-updates InRelease Get:4 https://dl.winehq.org/wine-builds/debian buster InRelease [6,259 B] Get:5 https://packages.microsoft.com/repos/vscode stable InRelease [3,959 B] Err:4 https://dl.winehq.org/wine-builds/debian buster InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 76F1A20FF987672F Err:5 https://packages.microsoft.com/repos/vscode stable InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EB3E94ADBE1229CF Reading package lists... Done ...
apt by default , will only accept the release files which are signed , and which have their public key installed . The release files of the distributions authored by the debian project are signed , and have their public keys installed , as such they were successfully downloaded. The release files from winehq and from Microsoft don't have their public keys installed , as such they are disregarded and they have caused apt to issue an error.
Each distribution has a Release , InRelease and Release.gpg files which are located in :
URI/dists/$DIST[/folder]/(Release , Release.gpg , InRelease) # URI : is a uniform resource identifier , # containing the address of the repository , # for example : # http://deb.debian.org/debian/ # https://packages.microsoft.com/repos/vscode # dists : is the dists folder under the URI # $DIST is a folder that has the distribution # suite name or code name for example stable # or buster. # [/folder] is an optional folder in the # the $DIST folder , for example it can # be updates. # Release : is a distribution release file. # It has its signature in the Release.gpg # file. # Release.gpg : is a file that contains the # signature of the Release file . # InRelease : is a distribution release file , # the signature is located inside the file itself. # e.g # https://deb.debian.org/debian/dists/stable/Release # https://deb.debian.org/debian/dists/stable/InRelease # https://deb.debian.org/debian/dists/stable/Release.gpg
The Release file has its signature located inside the Release.gpg file whereas the the InRelease file has its signature inside.
# https://packages.microsoft.com/repos/vscode/dists/stable/Release.gpg # Example of Release.gpg file from the stable distribution # authored by microsoft . # The Release.gpg file contains the signature for the # Release file. -----BEGIN PGP SIGNATURE----- Version: BSN Pgp v1.0.0.0 iQEcBAABCAAGBQJeHww5AAoJEOs+lK2+EinP1fQH/iwVUzvF7WJyQO95Ps6f4iGV EgaEWtWohTQZejVJP4GtuN1OnrUB+ttLS/hF89LB83Z9UM7Bs897bqHMrho4MI04 exm76vTWVmgRWnjuNAe3+BNDEBsVQALKhrOKHg5Ch7ASUkKKD6J9mFNjsBJZEet3 kjnLbdocJboX8MHLVHMp1SU0iCuyhyn0oHzTA+TMpO7ENj3wxdN93fCzhYtRcq8p 8oMz/aR8Sl5lo3Y/nFyRqVu018WlgoKhdRnoEgQTqSZHOLxeLXI+2KShwyruKS1Z jG9LI78YfIYQrVFuuiy8nKtVJrxtWGo9bGZfdTgfG7zFTee0oQljNfbATPbIbVc= =SPW1 -----END PGP SIGNATURE----- # https://packages.microsoft.com/repos/vscode/dists/stable/Release # Example of Release file from the stable distribution # authored by microsoft . # The signature of this Release file is located inside the # Release.gpg file . Origin: vscode stable Label: vscode stable Suite: stable Codename: stable Date: Wed, 15 Jan 2020 12:57:08 UTC Architectures: amd64 Components: main Description: Generated by aptly MD5Sum: 8ab7833de9b0b7c8fdc5f4dafd004f87 5821556 Contents-amd64 c698a25032c743673d96f4b6979f20e6 286333 Contents-amd64.gz 8ab7833de9b0b7c8fdc5f4dafd004f87 5821556 main/Contents-amd64 c698a25032c743673d96f4b6979f20e6 286333 main/Contents-amd64.gz 86921786810a44c60c340dbb5b4015ff 1093930 main/binary-amd64/Packages b3b91df3924d9628d6b089766bd0d596 160192 main/binary-amd64/Packages.bz2 1384193a462fa51e443373e92b56af09 170325 main/binary-amd64/Packages.gz 4c9ca25b556f111a5536c78df885ad82 95 main/binary-amd64/Release ... ... SHA512: 352cfac120c55a3ad5b838da8dbb1bfd5166ae85de5cb43da7600e6356532c582b461aee6417c2213789504398652f1abeffbe04d2fb3786458a42103230354b 5821556 Contents-amd64 9d227e1290537044bd284f96a18dfd72167132e030a7a8e4ae588e72fbb3348b407088903a67e7dbbd2d50c1e8c606d82b986bce3a391c7c1c5c0580f4376ede 286333 Contents-amd64.gz 352cfac120c55a3ad5b838da8dbb1bfd5166ae85de5cb43da7600e6356532c582b461aee6417c2213789504398652f1abeffbe04d2fb3786458a42103230354b 5821556 main/Contents-amd64 9d227e1290537044bd284f96a18dfd72167132e030a7a8e4ae588e72fbb3348b407088903a67e7dbbd2d50c1e8c606d82b986bce3a391c7c1c5c0580f4376ede 286333 main/Contents-amd64.gz aa7d98c3a43492ae9dea7ded57f5795054201dc1499170877cc44623d6690f63bef3de0f98022d6c82092fa9d6a864e1cf56cde13adb054253cfd0c60ee6f9ea 1093930 main/binary-amd64/Packages 28ab463c27d40339f49362d06d5b8ba711941056be5c58891f9ddb390e3bcf9ba7ae341e90176a80b43ffe5e210ee5dbae0d300820ee7ec58b1cdd6ad354238d 160192 main/binary-amd64/Packages.bz2 34ddebb21dbec11bd3d62e8548711a927f9c3444e559231769d16595501bc982b11937ee0dcc41c595f9daad470916941b92d7d5464fa073cb34f29bd9fed386 170325 main/binary-amd64/Packages.gz e1a4378ad266c13c2edf8a0e590fa4d11973ab99ce79f15af005cb838f1600f66f3dc6da8976fa8b474da9073c118039c27623ab3360c6df115071497fe4f50c 95 main/binary-amd64/Release # https://packages.microsoft.com/repos/vscode/dists/stable/InRelease # Example of InRelease file from the stable distribution # authored by microsoft . # The signature is located inside the InRelease file. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Origin: vscode stable Label: vscode stable Suite: stable Codename: stable Date: Wed, 15 Jan 2020 12:57:08 UTC Architectures: amd64 Components: main Description: Generated by aptly MD5Sum: 8ab7833de9b0b7c8fdc5f4dafd004f87 5821556 Contents-amd64 c698a25032c743673d96f4b6979f20e6 286333 Contents-amd64.gz 8ab7833de9b0b7c8fdc5f4dafd004f87 5821556 main/Contents-amd64 c698a25032c743673d96f4b6979f20e6 286333 main/Contents-amd64.gz 86921786810a44c60c340dbb5b4015ff 1093930 main/binary-amd64/Packages b3b91df3924d9628d6b089766bd0d596 160192 main/binary-amd64/Packages.bz2 1384193a462fa51e443373e92b56af09 170325 main/binary-amd64/Packages.gz 4c9ca25b556f111a5536c78df885ad82 95 main/binary-amd64/Release ... ... SHA512: 352cfac120c55a3ad5b838da8dbb1bfd5166ae85de5cb43da7600e6356532c582b461aee6417c2213789504398652f1abeffbe04d2fb3786458a42103230354b 5821556 Contents-amd64 9d227e1290537044bd284f96a18dfd72167132e030a7a8e4ae588e72fbb3348b407088903a67e7dbbd2d50c1e8c606d82b986bce3a391c7c1c5c0580f4376ede 286333 Contents-amd64.gz 352cfac120c55a3ad5b838da8dbb1bfd5166ae85de5cb43da7600e6356532c582b461aee6417c2213789504398652f1abeffbe04d2fb3786458a42103230354b 5821556 main/Contents-amd64 9d227e1290537044bd284f96a18dfd72167132e030a7a8e4ae588e72fbb3348b407088903a67e7dbbd2d50c1e8c606d82b986bce3a391c7c1c5c0580f4376ede 286333 main/Contents-amd64.gz aa7d98c3a43492ae9dea7ded57f5795054201dc1499170877cc44623d6690f63bef3de0f98022d6c82092fa9d6a864e1cf56cde13adb054253cfd0c60ee6f9ea 1093930 main/binary-amd64/Packages 28ab463c27d40339f49362d06d5b8ba711941056be5c58891f9ddb390e3bcf9ba7ae341e90176a80b43ffe5e210ee5dbae0d300820ee7ec58b1cdd6ad354238d 160192 main/binary-amd64/Packages.bz2 34ddebb21dbec11bd3d62e8548711a927f9c3444e559231769d16595501bc982b11937ee0dcc41c595f9daad470916941b92d7d5464fa073cb34f29bd9fed386 170325 main/binary-amd64/Packages.gz e1a4378ad266c13c2edf8a0e590fa4d11973ab99ce79f15af005cb838f1600f66f3dc6da8976fa8b474da9073c118039c27623ab3360c6df115071497fe4f50c 95 main/binary-amd64/Release -----BEGIN PGP SIGNATURE----- Version: BSN Pgp v1.0.0.0 iQEcBAEBCAAGBQJeHww4AAoJEOs+lK2+EinPnwYH/2ggyH6Frk+kneDByRop1mSG vmWDT2KrLa0Q1zI75I8UnlcslSuCiSycI+BELc6RRzmKGXvEXnslvLmAK5LFQ0tH VKCjVgdjQiFfw1Q1RDHYp0JngdhWb0ZunJ2zu8L4XvFZqiUzilr35UFXrY9Q/Hkg 9TKc2+flhnJCZ53UqKXkblBg+OLjyEWLIzYMHIDUBzrrt+IbzUgB3RuDMxm/hhpR 0wWiIbVifpa1w3WekywLaiJt7f19qzx64gskTuf9jO2dJUAPFRo5LKg7KZYqPl4L Kejl8NaarIEIOV30CTSFgkenz6lS4vo8Vw4WIT6yDGTvWas/HNUHoiNz7ltzH9k= -----END PGP SIGNATURE-----
A release file is signed by the distribution author private key. The signature will contain the hash of the release file . The hash is a mathematical code calculated by a function from a message , and is used to uniquely identify the message . The chances of hash collision , which is two messages having the same code , depends on the hashing algorithm. .
The signature of the release file also contains , the timestamp of when it was signed and the public key id of the author who signed this message . The public key id is the low order 64 bits of its fingerprint , and it consists of 16 hexadecimal digits ; It is used to locate the public key which will be used to verify the message .
@debian:~$ wget https://packages.microsoft.com/repos/vscode/dists/stable/Release.gpg # Get the Release.gpg file which contains # the signature of the Release file # from the stable distribution # authored by microsoft. @debian:~$ gpg --list-packets Release.gpg # List the packets inside this Release.gpg file. # off=0 ctb=89 tag=2 hlen=3 plen=284 :signature packet: algo 1, keyid EB3E94ADBE1229CF version 4, created 1579093049, md5len 0, sigclass 0x00 digest algo 8, begin of digest d5 f4 hashed subpkt 2 len 4 (sig created 2020-01-15) subpkt 16 len 8 (issuer key ID EB3E94ADBE1229CF) data: [2046 bits] # algo 1 : The public key algorithm , not the public key , # is RSA and it is used for encryption or for signing . # keyid EB3E94ADBE1229CF : Public key id is # EB3E94ADBE1229CF , this is used to locate the # public keys , which will be used to read the # signature . # 1579093049 : Timestamp of when the message was # created. # algo 8 : The hash algorithm used to compute the # hash of the message is SHA256 .
apt will use the public key gotten from the author of the distribution and identified by the key id to read the hashed value in the signature . The hashed value in the signature , is the hash of the original release file . apt will also calculate the hash of : the downloaded Release file , or of the message in the downloaded InRelease file , and compare it to the hash value read from the signature . If they are equal then the downloaded release file has been successfully verified , else the verification has failed and the release file is disregarded .