I am planning to run a production server on Ubuntu LTS 8.04 and I am concerned about security of the packages I am installing I want to make sure that packages that are downloaded by apt-get were not tampered with.
- How do I view the digital signatures associated with a package in ubuntu?
- Does apt-get install, apt-get update, apt-get upgrade automatically check digital signatures when downloading, installing packages or do I need to pass a command line option for these checks to happen?
- Who am I trusting when I install a package using apt-get install assuming that the package is part of the ubuntu main distribution, am I trusting canonical, debian, or an open source contributor?
apt-secure
manual page can answer most of your questions.sudo apt-key list
- You can also add/delete/update keys using the apt-key command (e.g.sudo apt-key update; sudo apt-key net-update
)