4

I'm looking a bit deeper into apt and I've a question regarding security. Maybe you could help me and provide an answer.

A) As far as I understand if apt is downloading a package from some kind of source it verifies that this package has not been tampered with during transfer. That means: As soon as apt has received that package (and provides it for installation) its integrity has already been confirmed.

B) As far as I understand each apt package internally contains checksums for each file stored in the package itself. This checksum file itself is signed. That means: At the moment apt is installing the package all (internal) package files have been checked against these checksums as well.

It is perfectly clear that A) is required. My question is: Why B)? Isn't that a bit "too much" security? Don't get me wrong: You can't have too little security here, but I'm wondering: Isn't that a bit excessive? Assuming that a distro repository is maintained reasonably well the checks of B) should not be necessary, don't they? Or the other way around: If the process A) already confirms the integrity of the package, why should process B) verify the integrity again?

Don't get me wrong: I'm not questioning the security infrastructure used here. I'm just trying to understand all aspects of it, especially the threats this security infrastructure tries to address.

0

2 Answers 2

6

One can obtain .deb files from sources that don't do your "A". While unpacking the packages, the installer does not "know" where the package came from, and uses the per file checksums to ensure integrity.

4
  • And maybe mention of debsums will be useful too for integrity checking.
    – N0rbert
    Nov 4, 2020 at 16:56
  • This A) is not mandatory??? Strange. For I-don't-know-how-many-years, I've never seen a repository not doing A). I thought this would be hard-coded into apt :-/
    – Regis May
    Nov 4, 2020 at 18:55
  • That is not what waltinator wrote. You can download a deb not using apt. He never said it had to come from a "repository". Integrity checks should always be done on the smallest install-able component otherwise you would need extra code for checking that specific part of the installation.
    – Rinzwind
    Nov 4, 2020 at 22:42
  • @Rinzwind: Hm. Looking at it from that perspective ... That is convincing. I think you're right.
    – Regis May
    Nov 5, 2020 at 1:42
2

Security, is a domain of history. It hard to cover every bit.

A. To verify before installation as package.

B. To verify after installation as files (right away or in the future, it is not a package anymore).

By the way, Debian & Ubuntu calculate different types of checksum. That's not just for convenient.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.