What are the GPG Signatures for?
What additional level of security do the Signatures add or provide to users?
What are some of the common problems associated with GPG Signatures with PPAs in Launchpad and why are they produced?
What is GPG?
GPG, or GNU Privacy Guard, is a suite of cryptographic software. It can be used to encrypt or sign data and communications to ensure its authenticity.
This type of cryptography is based on key pairs. A public key is hosted on a key server (e.g. keyserver.ubuntu.com) and the private key is kept secret. Using the public key, one can verify the signature made by a private key. Likewise, knowing someone's public key will allow you to encrypt a message that can only be read by the holder of the corresponding secret key.
Further Reading: GnuPG for Daily Use (a Mini How-To...)
What's this have to do with me?
In this context, the apt repository that you are downloading a package from should be signed by a secret key so that you can verify that the packages you are installing come from where they say they are.
The actual file in the repository that is signed is the
Further Reading: All about secure apt
The public key for the official Ubuntu archive is already know by your computer, but if you want to add a PPA or third-party repository you must import their key. If you try to update a repository whose key you don't have, you'll see warnings like:
When you install a package from that repository, you will also receive a warning:
While these warnings can be silenced by running
When adding a PPA you should use the
If you'd rather do this with out using the terminal, consult this answer.