Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are repository updates secure?

As a bear of little brain from the developer side, I cannot understand why the repository list is and the other http(unsecured) sites listed in /etc/apt/sources.list. Without a certificate chain match this appears as "ask any responder for a list of packages to update" instead of "ask the site..."

Can any network choose to spoof the update sites, and is this a common practice to provide a locally cached and vetted copy?

share|improve this question

In short, yes they're secure, because of public key cryptography used to sign the files.

All the files downloaded by APT have a signature that allows the downloaded file to be verified against the public keys stored on your computer as being signed by Ubuntu and only Ubuntu. This verifies that the file you receive was authorised by Ubuntu at some stage and hasn't been modified or tampered with since.

A technical explanation of how this works is available from Ubuntu (and from Debian which uses the same system).

Because of the use of HTTP instead of HTTPS, yes eavesdroppers could see what files you are downloading, but privacy is not likely to be your concern in this case. A man-in-the-middle attempt to modify the packages to inject harmful code would still fail because it would break the signing mechanism.

One possible gotcha in this signing mechanism is that it doesn't guarantee that you are getting the most up-to-date version of the package (indeed, sometimes mirrors are slow to update). To help mitigate this problem, the signed release file includes a "Valid-Until" date after which all the files it references should be considered stale. It would be plausible for a man-in-the-middle to substitute an archive with an unmodified earlier version of the archive within this Valid-Until date and cause your APT to believe there are no updates. But they can't make any arbitrary modifications to packages nor could they go back in time past a certain point.

The signing mechanisms provide much better security than HTTPS in this kind of distributed environment where the files are mirrored over many servers not controlled by Ubuntu. In essence you only need to trust Ubuntu, not the mirror, so you need to prove that the files originally came from Ubuntu and have not been modified since - there's no need to verify the identity of the mirror.

Note that when you add a non-official repository to your sources list, such as a PPA, you will be receiving files that are not signed by Ubuntu. APT should warn you about this, because they haven't been signed by a certificate matching any of the public keys installed on your computer as authorised by Ubuntu.

share|improve this answer
Great! So the short version is "the transport layer is not secure, but each package is signed. There is no secure list of available updates and patches for existing security issues are not guaranteed to be delivered." – Charles Merriam Oct 3 '13 at 3:36
Not sure what you mean by "There is no secure list of available updates" but the release file and package lists are signed. It's just that it doesn't verify that your mirror is up to date. – thomasrutter Oct 3 '13 at 6:08
Er, if there is no way to verify that a mirror, or the main site, is up to date then there is no way to know if there are updates available, security updates or otherwise. That is, there is no secure list of available updates. – Charles Merriam Oct 4 '13 at 3:30
But how is that related to HTTP vs HTTPS? How would connecting to a mirror via HTTPS prove that it is up to date? I don't see what the point you're getting at is. – thomasrutter Oct 4 '13 at 4:13
Alice runs Ubuntu. Bob controls Alice's Internet connection. Bob cannot put a bad package into Alice's installation because each package is signed. There is some huge security flaw found in Ubuntu. Alice try's to find the updated package, but Bob removes all mention of the package from Alice's update check. Alice whacks a sysadmin and then pulls the update check via HTTPS from verifying she is connected to the real website along a secure link. Now Alice sees the security update and Bob cannot hide it. – Charles Merriam Oct 6 '13 at 18:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.