I used the first option in Niry's excellent answer (more or less) to create a local repository during apt-get update
and via the APT::Update::Pre-Invoke
instruction in the apt configuration files. Thank you Niry.
I added some additional steps for on-the-fly package verification...
(Unfortunately I can't seem to add this follow-up as a comment inline; because of SE rules?)
Preamble
You'll notice that Niry's method adds the trusted flag deb [trusted=yes lang=none]
to the repo definition in /etc/apt/sources.list.d/zoomdebs.list
. This means that your local repo's list of checksums are explicitly trusted. These checksums were created from the downloaded file alone. While that deb is reasonably secure (as secure as zoom's download instructions (because https in the wget)), this does not however preclude the file zoom_amd64.deb, hosted by zoom.us, from somehow having been changed on their website. Most package systems do a package signature verification of one form or another. My system's package manager, (unless told not to) does this by pulling and checking the signature on the Release file via Release.gpg and then obtaining corresponding secure package checksums from the Packages file.
What were my additional steps then?
First you'll need debsig-verify
. apt-get install
– it, or whatever. Then follow Niry's guide option 1. In the resulting file /etc/apt/apt.conf.d/100update_zoom
which looks a bit like this:
APT::Update::Pre-Invoke {"cd /usr/local/zoomdebs && wget -qN https://zoom.us/client/latest/zoom_amd64.deb && && apt-ftparchive packages . > Packages && apt-ftparchive release . > Release";};
Add the command dpkg-sig --verify zoom_amd64.deb
thus:
APT::Update::Pre-Invoke {"cd /usr/local/zoomdebs && wget -qN https://zoom.us/client/latest/zoom_amd64.deb && dpkg-sig --verify zoom_amd64.deb && apt-ftparchive packages . > Packages && apt-ftparchive release . > Release";};
Now you'll need the Zoom package maintainer's gpg key. Get it how best suits your level of paranoia. I just used: wget -O Zoom.pubkey.pem https://zoom.us/linux/download/pubkey
but you could also go to e.g. Ubuntu's keyserver: https://keyserver.ubuntu.com/.... Then, if you're happy with that install it into apt's gpg keyring:
sudo apt-key add Zoom.pubkey.pem
If everything looks good then when you run apt-get update you should see the following, probably somewhere near the top of the output.
Processing zoom_amd64.deb...
GOODSIG _gpgbuilder 396060CADD8A75220BFCB369B903BF1861A7C71D 1643092553
If the update failed, you'll get a message like this:
E: Problem executing scripts APT::Update::Pre-Invoke 'cd /usr/local/zoomdebs && wget -qN https://zoom.us/client/latest/zoom_amd64.deb && dpkg-sig --verify zoom_amd64.deb && apt-ftparchive packages . > Packages && apt-ftparchive release . > Release'
E: Sub-process returned an error code