I just reinstalled Ubuntu so that I could take a more principled approach towards security with a fresh install.
The problem that I am having now is feeling confident installing software that isn't in the default package repositories. Right now I am trying to figure out TrueCrypt and Spotify.
My first attempt at asking for advice was regarding TrueCrypt and can be found on r/linux4noobs. Unfortunately I didn't get any responses.
TrueCrypt recommends checking the integrity of the installation tarball by downloading a signature, importing and signing their public key, and using something like 'gpg --verify'. I can download TrueCrypt's public PGP key directly from their website (sort of over HTTPS, but there doesn't appear to be any sort of SSL cert -- public key download) and confirm that it is the same one as is on MIT's PGP server. But since I haven't signed anyone else's PGP key, there's no way for me to know that the signatures that I see on MIT's PGP server for TrueCrypt are reliable. (I mean, I assume that they are, but that's not a great solution.) So it feels like there must be some way to bootstrap this process (without going to a keysigning event) for someone like me who just wants to check the integrity of software that I download. I now realize the importance of keysigning events, but it seems there should be another way as well. For example, why don't people/groups provide their public keys over HTTPS, using SSL certs as a bootstrapping mechanism?
In a similar vein, I am trying to install Spotify natively. They recommend adding their key using:
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 94558F59
But I assume this all happens in the clear, without any signing. Checking signatures on their key, I used the following:
$ sudo apt-key adv --list-sigs ... pub 2048R/94558F59 2012-06-25 [expires: 2015-06-25] uid Spotify Public Repository Signing Key <email@example.com> sig 3 94558F59 2012-06-25 Spotify Public Repository Signing Key <firstname.lastname@example.org>
It appears that the only signature is a self-signature. Again, I'm left feeling that I'm just kicking the can down the road. Sure, I'll be able to verify that the software I download was signed by the private key associated with the public key that I signed, but how do I gain confidence that the public key that I received belonged to who I thought it did?
I apologize for the wall of text, and if the answer is to read about PGP, I'm happy to. And I apologize for omitting links. Apparently without reputation only 2 links are allowed.
Thanks in advance for any help you can provide.