1

How can I trust any Repositories like

sudo add-apt-repository ppa:upubuntu-com/tor

or

sudo add-apt-repository ppa:wagungs/Kali-linux

1
  • 1
    GPG keys are a method of public key cryptography, and are safe enough to confirm that you did indeed download the package from where you were supposed to. Whether to trust that source or not cannot be verified by a key check (except probably keys which are universally established (eg Ubuntu package signing keys)).
    – xyz
    Aug 5, 2014 at 14:37

2 Answers 2

7

You can trust them as much as you trust the people who put them up. Anyone can put up a PPA; a repository owned by some random user is obviously less trustworthy than the official LibreOffice PPA, for example.

2

Good question. The short answer is: you can't trust them.

1
  • It's a layman's answer and doesn't consider the private repository set up locally for an organisation. Nuking everything isn't the solution. Feb 25, 2020 at 5:54

Not the answer you're looking for? Browse other questions tagged .