You have at least two ways of knowing where a package will come from:
--print-uris option to tell
apt-get to show where it will download the file from, but do nothing more.
# apt-get install iftop --print-uris
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
0 upgraded, 1 newly installed, 0 to remove and 4 not upgraded.
Need to get 35.9 kB of archives.
After this operation, 105 kB of additional disk space will be used.
'http://in.archive.ubuntu.com/ubuntu/pool/universe/i/iftop/iftop_1.0~pre2-1_amd64.deb' iftop_1.0~pre2-1_amd64.deb 35910 MD5Sum:a21d03c798bd7a553712e117b44806f5
apt-cache to see what are the candidates for installation and where they will be downloaded from:
# apt-cache policy iftop
500 http://in.archive.ubuntu.com/ubuntu/ precise/universe amd64 Packages
In general, if the URIs domains end with
.canonical.com, they can be considered trusted - these are official, first-party repositories or mirrors. Upload access to these are only granted to highly trusted developers.
If the URIs are of a different domain, check out the list of mirrors. If the domain is listed, they are also trustworthy.
Anything else, it's not certain.
apt to consider a source trusted, it must sign its packages, and the public key of the source should be added to
apt. When you add a PPA by
add-apt-repository, it will try to import the PPA's key. For other repositories, you might do something like:
wget -O - http://some.site/site.pub | apt-key add -
And you're again adding that source's key to
apt, marking it as trusted.