1

Hello this may seem very basic and general questions. (BUT)

Many times when I install software adding new repositories is the way to go. I use to follow instructions I find on the internet just like the one bellow:

curl -s https://example-browser-apt-release.s3.example.com/example-core.asc | sudo apt-key --keyring /etc/apt/trusted.gpg.d/example-browser-release.gpg add -

source /etc/os-release

echo "deb [arch=amd64] https://example-browser-apt-release.s3.example.com/ $LINUXDISTRO_CODENAME main" | sudo tee /etc/apt/sources.list.d/example-browser-release-${LINUXDISTRO_CODENAME}.list

sudo apt update

sudo apt install example-browser

However I don't really understand where this are stored.

  1. Are they stored all in one place?

  2. Is it possible to see like what repositories I have added over time and when

  3. Where are the keys stored

  4. Again is there any way to see which and when I added over time

  5. If I don't like the software is it important to remove them?

I know I am asking a lot of questions and maybe this are basic. Maybe I am missing a component here I should be aware of when installing external repositories. Any insight is welcomed.

Thank you very much.

1
  • 3
    "What is important to be careful about (for your security)" - honestly, not copying and pasting (sudo!) code off the internet that you don't understand is probably the biggest thing to be careful about for your security (but good on you for asking). Jul 12, 2019 at 3:52

2 Answers 2

2

This is only for apt systems, other package managers will be different.

Are they stored all in one place?

Do you mean the package archives or the files pointing to the repository? Package archives are stored in /var/cache/apt/archives. The specific repo files or entries are stored in /etc/apt/sources.list or /etc/apt/sources.list.d/*.list. Note that there is no necessary connection at all between where a repo is listed and the file that contains that listing. You could have, and in fact, Debian used to default to, most of the repos in /etc/apt/sources.list for example. Or you could have a repo from google in an opera.list file, the file names don't matter, what matters is the .list. But to make matters more predictable and maintainable, it's not a bad idea to make the repo filename correspond to the actual repo it points to.

Is it possible to see like what repositories I have added over time and when

You can see what repositories, I use inxi because it's easy.

inxi -r
Repos:
  Active apt repos in: /etc/apt/sources.list 
  1: deb http://mirrors.kernel.org/debian unstable main contrib non-free
  2: deb http://mirrors.kernel.org/debian/ buster main non-free contrib
  3: deb http://security.debian.org/debian-security buster/updates main contrib non-free
  4: deb https://liquorix.net/debian unstable main
  5: deb http://www.deb-multimedia.org/ buster main non-free
  Active apt repos in: /etc/apt/sources.list.d/google-chrome.list 
  1: deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main
  Active apt repos in: /etc/apt/sources.list.d/opera-stable.list 
  1: deb https://deb.opera.com/opera-stable/ stable non-free #Opera Browser (final releases)

You can also do:

cat /etc/apt/sources.list /etc/apt/sources.list.d/*.list

but that's harder to read, harder to type, and not as clear as to what file contains what. inxi is made to show that information cleanly.

The only way you can see when you added them I believe is if you add individual repo files, and then look at the file creation timestamp. There may be another way but I don't know of it.

Where are the keys stored

Good question, never thought about it. I'll see if I can find that one out.

According to: https://wiki.debian.org/SecureApt

they are found in /etc/apt/trusted.gpg.d and the file /etc/apt/trusted.gpg

ls /etc/apt/trusted.gpg.d -w 1
debian-archive-buster-automatic.gpg
debian-archive-buster-security-automatic.gpg
debian-archive-buster-stable.gpg
debian-archive-jessie-automatic.gpg
debian-archive-jessie-security-automatic.gpg
debian-archive-jessie-stable.gpg
debian-archive-stretch-automatic.gpg
debian-archive-stretch-security-automatic.gpg
debian-archive-stretch-stable.gpg
deb-multimedia-keyring.gpg

Comparing the repos I have with these, it looks like at least some of the repos are in fact stored in /etc/apt/trusted.gpg, and that's a non zero file size file.

Again is there any way to see which and when I added over time

Same question, same answer.

If I don't like the software is it important to remove them?

You should, to avoid clutter, and to avoid having to grab the repo data on apt-get update every time when you don't actually need that data. Plus random repos can and sometimes do just vanish or change or break, at which point you'll have an annoying apt update failure to debug. Also make sure to use apt-get remove --purge to avoid leaving configuration files for software you really don't want on your system. Without the --purge option, the configuration files are left in place.

With this said, pay attention to what Michael Horner said in his comment, that is the actually correct answer in my opinion if security is your main concern.

1

I'll answer the general question here, on the line of @MichaelHomer comment, because I think he hit the crucial point:

honestly, not copying and pasting (sudo!) code off the internet that you don't understand is probably the biggest thing to be careful about for your security

You ask "What is important to be careful about (for your security) when adding repositories (keyring, sources-list, etc)?"

This all boils down whether you trust or not the maintainer of the repository to run software in your machine. Once you add a repo, you authorize and trust any software and package contained in that repo. This is perfectly fine for official distros' base repos (Debian, CentOS, etc.) and OK for well-known repos (EPEL, Atlassian, etc.). For unknown and obscure maintained repos, you should be wary and avoid adding them. Where their components are stored isn't important at all in this view.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .