Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Windows has a signature system which allows you to make sure that an executable hasn't been modified after it has been signed. I used to use this as a security measure in Windows. enter image description here enter image description here

Does linux have such a system which allows developers to put signatures in executables and .debs so that the user can verify them? So, for example some one gives me a modified version of a program. I can see if the programs signature is valid or if it has a signature in the first place.

share|improve this question
add comment

2 Answers

up vote 14 down vote accepted

Software that is in the repositories does not really need a signature. We can assume that the software coming from those can be trusted.

But it is possible to check it through its md5 checksum. Launchpad page on MD5 checksum step 2:

Step 2: Open a terminal, change to the directory where you have saved the file and accompanying signature, then enter the following:

gpg --verify signaturefilename

Replace signaturefilename with the signature's filename.

gpg will now try to check the signature against the signer's public key. If your version of gpg is configured to retrieve public keys automatically, you can skip to step 4. Otherwise, you'll need to fetch the signer's public key manually.

share|improve this answer
    
Thanks for this info. But what about portable excutables and .debs that are not available in repositories. Also those which I've backed up using "apt on cd". Is there a way to check the signatures of these before they are installed. –  Ufoguy Dec 13 '13 at 15:29
2  
Launchpad is about non-repository packages: anyone can upload their own private package on launchpad and create a sources.list line to install. If an uploader signed it you can use that but regardless of that launchpad also creates md5 hashes for anyone to check validity. Any file can be checked if you have the md5 hash. Heck, I would go as far as claiming: no md5 hash = untrusted. –  Rinzwind Dec 13 '13 at 16:03
add comment

DigSig (Digital Signature... in the Kernel) and DSI (Distributed Security Infrastructure), but unfortunately, this project is no longer maintained.

DigSig, is a Linux kernel module, which checks RSA digital signatures of ELF binaries and libraries before they are run. Binaries are to be signed with BSign.

DSI (Distributed Security Infrastructure), is a security framework which targets distributed environments, and is meant to address any specific security issue such platforms may be concerned with. More particularly, it is meant to address security needs of carrier-grade Linux clusters, for the telecommunication domain.DigSig

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.