31

I have read the following article: How do I bypass/ignore the gpg signature checks of apt?

It outlines how to configure apt to not check the signatures of packages at all.

However, I'd like to limit the effect of this setting to a single (in this case locally hosted) repository.

That is: all official repositories should use the GPG signature check as usual, except for the local repo.

How would I go about doing that?

Failing that, what would be the advantage (security-wise) of signing the packages during an automated build (some meta-packages and a few programs) and then doing all that secure apt prescribes? After all the host with the repo would then also be the one on which the secret GPG key resides.

  • In my opinion automated signing using an online key, while far from ideal, would be strictly better than not signing at all. It would also be much easier to set up (no need to configure each client to waive the checks) and much easier to transition to a better setup later should you want to. – Celada Apr 22 '15 at 21:31
  • @Celada: is that an opinion (that it's "strictly better") or is there a rationale for your statement? I'm asking, because so far I cannot see a reason how this would improve security or any other aspect. The only time when this would be somewhat beneficial, would be if I ever intended to publish my repo after all, no? – 0xC0000022L Apr 22 '15 at 21:43
  • I hold that opinion rationally :-) If the repository is signed, then at least the bad guys have to get the signing key, which you will probably keep in only one place and probably on a dev box, or at least not readable by the HTTP server. Otherwise there is no protection at all. In other words I just mean to say that there is no disadvantage to signing, so you might as well sign even if the advantage is only tiny. And since it would be easier to set up, that's what I would go with. – Celada Apr 22 '15 at 21:56
  • @Celada: this is a repository for local use only. Who would be able to access it. Use case: a host with guest containers. Both host and containers will have access. No public access planned. But I guess I'll hold out for an answer a bit longer and go for the otherwise inevitable (signing). – 0xC0000022L Apr 22 '15 at 22:04
  • Fair enough, we'll see if someone knows the answer to your question. I don't know what tool you're planning to use to generate the repo, but I recommend reprepro. A lot of the other tools like dput (or whatever Debian itself uses) are very elaborate and seem like huge overkill for local-only ad hoc repo. reprepro will take care of generating the repo with all the correct directory layout and index files automatically without needing a big database server installation... and it will also sign the result with basically no additional work on your part. – Celada Apr 22 '15 at 22:15
43

You can set options in your sources.list:

deb [trusted=yes] http://localmachine/debian wheezy main

The trusted option is what turns off the GPG check. See man 5 sources.list for details.

Note: this was added in apt 0.8.16~exp3. So it's in wheezy (and of course jessie), but not squeeze.

  • thanks a bunch. This was exactly what I was looking for. I trust 1.0.1ubuntu2.7 will have that feature already, given its version number. – 0xC0000022L Apr 24 '15 at 20:05
  • @0xC0000022L yes, it should. – derobert Apr 24 '15 at 20:10
  • This is definitely the best answer if you repeatedly need to access an unsigned repository, there are updated answers to the other question linked in the original question here showing how to temporarily do it per repository. – dragon788 Sep 1 '17 at 20:12
8
+100

To make sure that you see a warning while using an insecure repository, better use allow-insecure=yes instead like below

deb [ allow-insecure=yes ] ...
  • Interesting, thanks for your answer. A small but important difference indeed. – 0xC0000022L Nov 8 '18 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.