2

When I run this apt-get install package_name in SSH, the package is installed, but from which site?

Is it http://packages.debian.org ?

I know in ruby when you run gem intall xxx, the gem is downloaded from rubygems.org. Not that long ago, the site was hacked and the hackers installed a payload in 1 gem. It is possible to find the gems at github and see what is going on. Rubygems also have a status.rubygems.org. Is there any similar for debian packages?

5

2 Answers 2

4

Type:

apt-cache policy package_name

And it'll tell you. On Ubuntu, it's usually archive.ubuntu.com, but you may have other sources set up.

1
2
cat /etc/apt/sources.list
cat /etc/apt/sources.d/*

should show you the repos used. I don't know how rubygems.org was protected but here is some useful pieces of advice on apt: http://wiki.debian.org/SecureApt it's for debian but it also applies to Ubuntu which uses the same packet manager.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .