Is Ubuntu's archive signing key available via HTTPS somewhere?

Question

I'm writing a program that needs to download GPG keys for various distributions to do unattended net installs. To do this securely and in an automated way, I need to download the key via HTTPS, which means "gpg --recv-keys" isn't an option. Other distributions (e.g., Fedora) make their keys available on their websites via HTTPS (e.g., https://fedoraproject.org/static/E8E40FDE.txt), but I can't find the Ubuntu key file anywhere on ubuntu.com. Does anyone know where I can get it via HTTPS?

Answer 1

The keys are available in the ubuntu-keyring package. So, as with any Ubuntu package, you can download it from Launchpad, which does provide HTTPS (pick a suitable release and download the tarballs or deb files as needed).

---

As it happens, you can get GnuPG2 to import the keys over HKPS (HKP with SSL), so it's possible to --recv-keys securely, but the process is a bit annoying. To use HKPS, we need to:

• tell dirmngr to use an HKPS keyserver
• tell dirmngr where the CA Certificates are
• get the keys via gpg2 instead of gpg - the apt-key command calls gpg, and gpg doesn't seem to support HKPS (at any rate, it tries to execute /usr/lib/gnupg/gpgkeys_hkp which fails with an unsupported protocol error)
• export the key and import it with sudo apt-key add

HKPS and dirmngr

Ideally, we're supposed to use gpgconf to set configuration options for dirmngr and gpg2. But gpgconf doesn't understand one option we use, --hkp-cacert for dirmngr. So we might as well do it all manually.

First, let's create a symbolic link to /etc/ssl/certs/ca-certificates.crt because dirmngr wants a PEM extension:

ln -s /etc/ssl/certs/ca-certificates.crt ~/.ca-certs.pem

Edit ~/.gnupg/dirmngr.conf (create if necessary) and add these two options to it:

keyserver hkps://keyserver.ubuntu.com
hkp-cacert ~/.ca-certs.pem

Kill dirmngr if necessary:

pkill dirmngr

Import key with GnuPG2

With the dirmngr options set, this is simple:

$ gpg2 --verbose --recv-keys 0xBA6932366A755776
gpg: no running Dirmngr - starting '/usr/bin/dirmngr'
gpg: waiting for the dirmngr to come up ... (5s)
gpg: connection to the dirmngr established
gpg: data source: https://cassava.canonical.com:443
gpg: armor header: Version: SKS 1.1.6
gpg: armor header: Comment: Hostname: keyserver.ubuntu.com
gpg: pub  rsa4096/6A755776 2017-07-29  Launchpad PPA for deadsnakes
gpg: key 6A755776: "Launchpad PPA for deadsnakes" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

Yay!

Add key to apt

Another simple step:

$ gpg2 --export 0xBA6932366A755776 | sudo apt-key add
OK

Optionally, we can now delete the added key from the user keyring, since it's unlikely to be needed again:

$ gpg2 --delete-keys 0xBA6932366A755776
gpg (GnuPG) 2.1.11; Copyright (C) 2016 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

pub  rsa4096/6A755776 2017-07-29 Launchpad PPA for deadsnakes

Delete this key from the keyring? (y/N) y

These steps are not difficult to automate.

Answer 2

I suggest you use ""gpg --recv-keys" , apt will then confirm the key

How apt uses Release.gpg

Secure apt always downloads Release.gpg files when it's downloading Release files, and if it cannot download the Release.gpg, or if the signature is bad, it will complain, and will make note that the Packages files that the Release file points to, and all the packages listed therein, are from an untrusted source. Here's how it looks during an apt-get update:

W: GPG error: http://ftp.us.debian.org testing Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 010908312D230C5F

See http://wiki.debian.org/SecureApt

and http://wiki.debian.org/SecureApt#How_to_tell_if_the_key_is_safe

Answer 3

Yes: Ubuntu's key can be found on https://keys.openpgp.org

Here's a script I wrote to automate importing keys via HTTPS. It works because openpgp's HTTPS path is predictable and only varies by key fingerprint.

To adapt script to your own purposes, just set the variable PATHSCRIPTS and replace the (3) specimen keyprints in the Here-Doc inside the script with those of the Ubuntu keys (or any keys found on https://keys.openpgp.org) you wish to import.

#!/bin/bash

PATHSCRIPTS='/home/REPLACEWITHYOURUSERNAME'

# Create text file using a Here-Doc containing Key Fingerprints of keys to import into keyring:

cat <<EOF> $PATHSCRIPTS/Key-fingerprints-list.txt
AEB042FFD73BAA7545EDA021343A2DF613C5E7F8
7AFAF20259E69236E43EEF521F45D0F6E89F27A6
704FCD2556C40AF8F2FBD8E2E5A1DE67F98FA66F
EOF

# Read the text file we created into an array
readarray arrayKeyFingerprints < $PATHSCRIPTS/Key-fingerprints-list.txt

# Loop through the array adding each key in turn by its fingerprint from keys.openpgp.org:
for i in ${arrayKeyFingerprints[@]}; do
    curl https://keys.openpgp.org/vks/v1/by-fingerprint/$i | gpg --import
done

Results of the above script- which was saved and executed as test.sh- shown below:

pi@pi4-ap1:~ $ ./test.sh 
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                             Dload  Upload   Total   Spent    Left  Speed
100  3212  100  3212    0     0   7629      0 --:--:-- --:--:-- --:--:--  7629
gpg: /home/pi/.gnupg/trustdb.gpg: trustdb created
gpg: key 343A2DF613C5E7F8: public key "Terrence Houlahan (I'm the former NYPD cop living in the UK.  This is my only *personal* key.  Trust no others.) <terrence@houlahan.co.uk>" imported
gpg: Total number processed: 1
gpg:               imported: 1
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                             Dload  Upload   Total   Spent    Left  Speed
100  3220  100  3220    0     0  18720      0 --:--:-- --:--:-- --:--:-- 18612
gpg: key 1F45D0F6E89F27A6: public key "Terrence Houlahan (Terrence Houlahan Linux & Network Engineer) <houlahan@F1Linux.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                             Dload  Upload   Total   Spent    Left  Speed
100  3252  100  3252    0     0  19473      0 --:--:-- --:--:-- --:--:-- 19473
gpg: key E5A1DE67F98FA66F: public key "Terrence Houlahan (Open-IPcamera Project Developer Key Terrence Houlahan) <terrence.houlahan@open-ipcamera.net>" imported
gpg: Total number processed: 1
gpg:               imported: 1