4

According to BuildYourOwnKernel there are two ways to get the source code:

apt-get

  • Is apt-get signed by the Ubuntu team?
  • I mean, will my computer verify the signature when I download it?
  • Is there a way I can verify myself the signature with an alternative method?

git

Git source code is not signed.

  • Is there a place where I can find the signature?
  • I can see that git tags are signed, but I can't get the public keys and neither can I verify that these public keys are secure (are they signed by the Ubuntu team?)
Improve this question
6
  • Yes, apt archives are signed. See the many threads about importing keys when they get updated :)
    – ivanivan
    Feb 19, 2018 at 16:22
  • 1
    Git source code is not singed -- worth noting that it often can be (indirectly, as a commit signature), which combined with the transparent nature of open source makes this strictly more trustworthy than a signed binary.
    – Jules
    Feb 19, 2018 at 17:38
  • @Jules: In practice though it's only so if you read the entire source code, understand all of it in entirety, and can identify any and all possible injected vulnerabilities at a glance.
    – Lightness Races in Orbit
    Feb 19, 2018 at 18:33
  • @LightnessRacesinOrbit you say that like the kernel isn't 4 plus million lines of light weekend reading :)
    – Jules
    Feb 19, 2018 at 18:36
  • 1
    @Jules: :P Nightcap, amirite?
    – Lightness Races in Orbit
    Feb 19, 2018 at 18:38

1 Answer 1

Reset to default
9

Is apt-get signed by the ubuntu team?

Well, the dsc file is signed and contains hashes of the files to be downloaded:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.0
Source: linux
...
Checksums-Sha1:
 180ab617036593212274177eff3a67f437c1b5ea 132860730 linux_4.4.0.orig.tar.gz
 be23819008464f4aa49bed094d19aac086f16572 13880183 linux_4.4.0-112.135.diff.gz
Checksums-Sha256:
 730e75919b5d30a9bc934ccb300eaedfdf44994ca9ee1d07a46901c46c221357 132860730 linux_4.4.0.orig.tar.gz
 b5b6adc87ea98ffa48d31aee2ee5ec301a01c2b4fa64fa20d1564a4e95bdd6ad 13880183 linux_4.4.0-112.135.diff.gz
Files:
 2070b49688e8d7ee7ff4c33590afc698 132860730 linux_4.4.0.orig.tar.gz
 b349ae228d1659789e713b8ff2262eac 13880183 linux_4.4.0-112.135.diff.gz

So a signed dsc file with checksums of the tarballs in it ~ closest you'll get to signed source code.

I mean, will my computer verify the signature when I download it?

It does try. apt-get does attempt to verify it:

$ apt-get source linux-image-4.4.0-87-generic
Reading package lists... Done
Picking 'linux' as source package instead of 'linux-image-4.4.0-87-generic'
NOTICE: 'linux' packaging is maintained in the 'Git' version control system at:
git://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/xenial
Please use:
git clone git://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/xenial
to retrieve the latest (possibly unreleased) updates to the package.
Need to get 147 MB of source archives.
Get:1 ftp://ftp.iitb.ac.in//os/ubuntu/archives/ubuntu xenial-security/main linux 4.4.0-112.135 (dsc) [9,712 B]
Get:2 ftp://ftp.iitb.ac.in//os/ubuntu/archives/ubuntu xenial-security/main linux 4.4.0-112.135 (tar) [133 MB]
Get:3 ftp://ftp.iitb.ac.in//os/ubuntu/archives/ubuntu xenial-security/main linux 4.4.0-112.135 (diff) [13.9 MB]
Fetched 147 MB in 4s (31.8 MB/s)
gpgv: Signature made Fri 19 Jan 2018 17:14:04 IST using RSA key ID CBEECEA3
gpgv: Can't check signature: public key not found
dpkg-source: warning: failed to verify signature on ./linux_4.4.0-112.135.dsc
dpkg-source: info: extracting linux in linux-4.4.0
dpkg-source: info: unpacking linux_4.4.0.orig.tar.gz
dpkg-source: info: applying linux_4.4.0-112.135.diff.gz
dpkg-source: info: upstream files that have been modified:

But in my case it didn't succeed because I hadn't imported the corresponding key yet. The dsc files are usually signed by the developer who created it, and AFAICT there is no single place where all such keys are listed. The various Ubuntu developers are members of various groups on Launchpad, and the Launchpad profiles of the developers should list their GPG keys. For example, see the Ubuntu Kernel Uploaders team, or the combined Ubuntu Developers team (which in turn includes many other teams).

In this specific case, the signer is Canonical employee Stefan Bader. You can fetch the key from the Ubuntu keyserver, but you might want to do so using HKPS.

Is there a way I can verify myself the signature with an alternative method?

The dscverify tool can be used for that.

I can see that git tags are signed, but I can't get the public keys and neither can I verify that these public keys are secure (are they signed by the Ubuntu team?)

Well, going by Stefan Bader's or Andy Whitcroft's (who seems to have signed this tag, for example) keyserver listings, yes.

Improve this answer
8
  • Could you explain better this lookup page? What does this means? For example, I need to verify this tag: kernel.ubuntu.com/git/ubuntu/ubuntu-bionic.git/tag/… how do I get his key and verify it? Also, how to verify that his key is signed by ubuntu team?
    – Guerlando OCs
    Feb 19, 2018 at 13:49
  • @GuerlandoOCs copy that signature to a file and run gpg on it. You'll get something like this: paste.ubuntu.com/p/F2cZ9vy77b. Looking up the corresponding key: keyserver.ubuntu.com/pks/…, which lists several signatures, and if you check the public key (keyserver.ubuntu.com/pks/…) given there, you'll see it does indeed contain several signature packets: paste.ubuntu.com/p/24BP3RwCQm
    – muru
    Feb 19, 2018 at 13:57
  • Now whether you trust those signatures, and how you'll verify the keys of the people who signed it is ... Well, best try to meet one of these people in person, I suppose.
    – muru
    Feb 19, 2018 at 13:57
  • See also: "example 1 bis" in irif.fr/~jch/software/pgp-validating.html
    – muru
    Feb 19, 2018 at 14:01
  • So now I know the key which signed it is AB4800A62DB9F73A. I don't know what is displayed on the lookup page but I guess it's the list of people who signed his key right? I did run gpg --recv 0xab4800a62db9f73a to receive his key, now I should just verify the tag with git. The next step would be confirming that this key is indeed from him, right? (and confirming that him is a developer or something like that). Isn't there a signature from ubuntu at least confirming that they were part of the development team or something like that? At least an https page which lists them as devs?
    – Guerlando OCs
    Feb 19, 2018 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.