I want to add a feature to pam, and I figured a good starting point was to download the libpam-modules
source. On download, I notice this warning: gpgv: Can't check signature: public key not found
What is the official method for verifying the integrity of source packages, when apt-get
cannot find the public key?
The newest version of ubuntu-keyring
and debian-keyring
packages are installed already.
There are ways to find the corresponding public key and install it. However that in itself does not provide integrity, because in effect it is trusting the contents of the dsc
file to tell me which public key to use to verify the signature on the dsc
file.
Is the gpg signature on the dsc
file a critical part of the integrity verification? Could a man in the middle or a rouge mirror serve a malicious version of the file where the warning from gpg is the only indication something bad is happening? Or does apt-get
have other means of validating the integrity?
Where would I find official documentation on the security model? Ideally I would like to understand the full trust path from the install image to the source package I am downloading.
The full output from the download was this:
$ apt-get source libpam-modules
Reading package lists... Done
Building dependency tree
Reading state information... Done
Picking 'pam' as source package instead of 'libpam-modules'
NOTICE: 'pam' packaging is maintained in the 'Bzr' version control system at:
https://code.launchpad.net/~ubuntu-core-dev/pam/ubuntu
Please use:
bzr branch https://code.launchpad.net/~ubuntu-core-dev/pam/ubuntu
to retrieve the latest (possibly unreleased) updates to the package.
Need to get 2,043 kB of source archives.
Get:1 http://dk.archive.ubuntu.com/ubuntu/ trusty/main pam 1.1.8-1ubuntu2 (dsc) [2,510 B]
Get:2 http://dk.archive.ubuntu.com/ubuntu/ trusty/main pam 1.1.8-1ubuntu2 (tar) [1,893 kB]
Get:3 http://dk.archive.ubuntu.com/ubuntu/ trusty/main pam 1.1.8-1ubuntu2 (diff) [147 kB]
Fetched 2,043 kB in 6s (316 kB/s)
gpgv: Signature made Fri 31 Jan 2014 11:12:23 PM CET using RSA key ID 64792D67
gpgv: Can't check signature: public key not found
dpkg-source: warning: failed to verify signature on ./pam_1.1.8-1ubuntu2.dsc
dsc
file downloaded over http. What prevents a man in the middle from serving adsc
file signed with a different key?