0

I need to create a linux installation image where I later have to install additional packages without internet access. I have to check that the image as well as the packages are genuine.

Step 1 is easy: Go to https://alpinelinux.org/downloads/, get the image, signature and sha sum and check them.

I just don't know how to download a package from alpine and check the validity of that package. Are they signed at all?

The same would be true for debian, too, by the way...

The hashsums seem to be part of alpine packages. How can I check them? Are they signed?

1
  • 1
    Package signing is automatically done by apk. The packages built in the repo are signed and when installed are checked with the keys you can find in /etc/apk/keys. So it works out-of-the-box if you are using official repositories. If you are planning to add some custom packages built by yourself, you need to add your keys in /etc/apk/keys. If you want to know more in-depth how signing works within Alpine, check this doc: wiki.alpinelinux.org/wiki/Apkindex_format Commented Jun 23, 2020 at 13:06

1 Answer 1

0

Package signing is automatically done by apk.

The packages built in the repo are signed and when installed are checked with the keys you can find in /etc/apk/keys, so it works out-of-the-box if you are using official repositories.

If you are planning to add some custom packages built by yourself, you need to add your keys in /etc/apk/keys. These keys can be created with the command abuild-keygen. You can find more info on this topic on: https://wiki.alpinelinux.org/wiki/Include:Abuild-keygen

If you want to know more in-depth how signing works within Alpine, check this doc: https://wiki.alpinelinux.org/wiki/Apkindex_format

.: Francesco

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .