Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I trust any Repositories like

sudo add-apt-repository ppa:upubuntu-com/tor


sudo add-apt-repository ppa:wagungs/Kali-linux

share|improve this question

marked as duplicate by saiarcot895, dobey, Warren Hill, Seth Aug 5 '14 at 14:31

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

GPG keys are a method of public key cryptography, and are safe enough to confirm that you did indeed download the package from where you were supposed to. Whether to trust that source or not cannot be verified by a key check (except probably keys which are universally established (eg Ubuntu package signing keys)). – prakharsingh95 Aug 5 '14 at 14:37
up vote 6 down vote accepted

You can trust them as much as you trust the people who put them up. Anyone can put up a PPA; a repository owned by some random user is obviously less trustworthy than the official LibreOffice PPA, for example.

share|improve this answer

Good question. The short answer is: you can't trust them.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.