I want to add a feature to pam, and I figured a good starting point was to download the
libpam-modules source. On download, I notice this warning:
gpgv: Can't check signature: public key not found
What is the official method for verifying the integrity of source packages, when
apt-get cannot find the public key?
The newest version of
debian-keyring packages are installed already.
There are ways to find the corresponding public key and install it. However that in itself does not provide integrity, because in effect it is trusting the contents of the
dsc file to tell me which public key to use to verify the signature on the
Is the gpg signature on the
dsc file a critical part of the integrity verification? Could a man in the middle or a rouge mirror serve a malicious version of the file where the warning from gpg is the only indication something bad is happening? Or does
apt-get have other means of validating the integrity?
Where would I find official documentation on the security model? Ideally I would like to understand the full trust path from the install image to the source package I am downloading.
The full output from the download was this:
$ apt-get source libpam-modules Reading package lists... Done Building dependency tree Reading state information... Done Picking 'pam' as source package instead of 'libpam-modules' NOTICE: 'pam' packaging is maintained in the 'Bzr' version control system at: https://code.launchpad.net/~ubuntu-core-dev/pam/ubuntu Please use: bzr branch https://code.launchpad.net/~ubuntu-core-dev/pam/ubuntu to retrieve the latest (possibly unreleased) updates to the package. Need to get 2,043 kB of source archives. Get:1 http://dk.archive.ubuntu.com/ubuntu/ trusty/main pam 1.1.8-1ubuntu2 (dsc) [2,510 B] Get:2 http://dk.archive.ubuntu.com/ubuntu/ trusty/main pam 1.1.8-1ubuntu2 (tar) [1,893 kB] Get:3 http://dk.archive.ubuntu.com/ubuntu/ trusty/main pam 1.1.8-1ubuntu2 (diff) [147 kB] Fetched 2,043 kB in 6s (316 kB/s) gpgv: Signature made Fri 31 Jan 2014 11:12:23 PM CET using RSA key ID 64792D67 gpgv: Can't check signature: public key not found dpkg-source: warning: failed to verify signature on ./pam_1.1.8-1ubuntu2.dsc