Why must apt GPG-keys be world-readable?

Question

When using the "Signed-by" option for apt repo entries, apt throws an error if the key is not world-readable.

Example:

deb [arch=amd64 signed-by=/etc/apt/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com jammy main

sudo chmod 660 /etc/apt/keyrings/hashicorp.gpg
sudo apt-get update  


https://apt.releases.hashicorp.com jammy InRelease  
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DA418C88A3219F7B  

sudo chmod 664 /etc/apt/keyrings/hashicorp.gpg  
sudo apt-get update  
Hit:10 https://apt.releases.hashicorp.com jammy InRelease  

Why is this?

Answer 1

They don't have to be world readable, but they do have to be readable by the user apt runs as. Apt, even when run as root, typically drops privileges for actions that don't need them, by switching to the _apt user. For example:

# getent passwd _apt
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
# strace -f apt update |& grep si_uid
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=708, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
[pid   709] --- SIGINT {si_signo=SIGINT, si_code=SI_USER, si_pid=707, si_uid=0} ---
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=709, si_uid=0, si_status=100, si_utime=0, si_stime=0} ---
[pid   712] --- SIGINT {si_signo=SIGINT, si_code=SI_USER, si_pid=707, si_uid=0} ---
[pid   707] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=712, si_uid=0, si_status=SIGINT, si_utime=0, si_stime=0} ---
[pid   715] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=716, si_uid=100, si_status=0, si_utime=0, si_stime=0} ---
[pid   717] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=718, si_uid=100, si_status=0, si_utime=0, si_stime=0} ---
[pid   715] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=717, si_uid=100, si_status=0, si_utime=0, si_stime=0} ---

Note the UID of many of the child processes is 100, that of the _apt user.

That said, there's no advantage to be gained from making the keys readable only by root.