How to know with which key a repository is signed by (and vice versa)?

Question

I want to use the signed-by option on all the repositories of my /etc/apt/sources.list.d/debian.sources, point to the keys in /usr/share/keyrings instead of /etc/apt/trusted.gpg.d before disabling this directory, as I have understood, this old way of doing is insecure. I don't know if this only apply to third-party repositories but better be safe than sorry.

However, when adding the signed-by option, I found myself unable to know which key to link to which repo, seeing that the key's names don't match the repos:

debian-archive-bullseye-automatic.gpg
debian-archive-bullseye-security-automatic.gpg
debian-archive-bullseye-stable.gpg
debian-archive-buster-automatic.gpg
debian-archive-buster-security-automatic.gpg
debian-archive-buster-stable.gpg
debian-archive-keyring.gpg
debian-archive-removed-keys.gpg
debian-archive-stretch-automatic.gpg
debian-archive-stretch-security-automatic.gpg
debian-archive-stretch-stable.gpg

My /etc/apt/sources.list.d/debian.sources looking like this:

Types: deb
URIs: https://deb.debian.org/debian/
Suites: buster
Components: main
Signed-By: /usr/share/keyrings/debian-archive-buster-stable.gpg

Types: deb-src
URIs: https://deb.debian.org/debian/
Suites: buster
Components: main
Signed-By: /usr/share/keyrings/debian-archive-buster-stable.gpg

Types: deb
URIs: https://security.debian.org/debian-security
Suites: buster/updates
Components: main
Signed-By: /usr/share/keyrings/debian-archive-buster-security-automatic.gpg

Types: deb-src
URIs: https://security.debian.org/debian-security
Suites: buster/updates
Components: main
Signed-By: /usr/share/keyrings/debian-archive-buster-security-automatic.gpg

Types: deb
URIs: https://deb.debian.org/debian/
Suites: buster-updates
Components: main
Signed-By: /usr/share/keyrings/debian-archive-buster-automatic.gpg

Types: deb-src
URIs: https://deb.debian.org/debian/
Suites: buster-updates
Components: main
Signed-By: /usr/share/keyrings/debian-archive-buster-automatic.gpg

Types: deb
URIs: https://deb.debian.org/debian
Suites: buster-backports
Components: main
Signed-By: /usr/share/keyrings/debian-archive-buster-automatic.gpg

This doesn't throw me any error when doing apt update and I can install software but I would like to know a method to know for sure which key I should append to the signed-by option for each repo without having to do guesswork, and be left with doubts.

I know of apt-key list but the information are pretty much the same, how does "Debian Security Archive Automatic Signing Key" is supposed to tell us that it signs buster-updates AND buster-backports? Is it normal that one key can sign multiple suites? I would have expected one key per suite.

Also, the opposite: how do I know what a key signs? How do I know I don't have useless keys in /usr/share/keyrings or that they are signing malicious repositories?

Answer 1

For context, current best practices for third-party repositories are documented in the Debian wiki page on third-party repository usage and in this “How to properly use 3rd party Debian repository signing keys with apt” blog post. Eventually they should be extended to Debian’s own repositories, see this issue for example.

Assuming you trust your current setup, you can map signed archive release files to keys by listing the keys used to sign them; for example:

$ gpgv /var/lib/apt/lists/security.debian.org_dists_buster_updates_InRelease
gpgv: Signature made Mon 07 Jun 2021 23:03:07 CEST
gpgv:                using RSA key 379483D8B60160B155B372DDAA8E81B4331F7F50
gpgv: Can't check signature: No public key
gpgv: Signature made Mon 07 Jun 2021 23:03:07 CEST
gpgv:                using RSA key 5237CEEEF212F3D51C74ABE0112695A0E562B32A
gpgv: Can't check signature: No public key

shows that the Debian 10 security updates are signed by RSA keys 379483D8B60160B155B372DDAA8E81B4331F7F50 and 5237CEEEF212F3D51C74ABE0112695A0E562B32A. These are respectively “Debian Security Archive Automatic Signing Key (9/stretch)” and “Debian Security Archive Automatic Signing Key (10/buster)”. To determine that, look at the individual keyrings in /usr/share/keyrings, with a command such as for file in /usr/share/keyrings/*.gpg; do echo $file; gpg --list-keys --no-default-keyring --with-subkey-fingerprint --keyring $file; done.

This isn’t ideal; for more authoritative usage information, you can apply the following rules:

• “stable” keys (e.g. “Debian Stable Release Key (10/buster)”) are used with the corresponding stable repositories;
• automatic keys are used as described in their announcement emails, e.g. the Buster keys and the Bullseye keys.

Repository indexes are often signed by two keys to allow for some overlap.

You shouldn’t care about individual files under /usr/share/keyrings, but rather about packages providing files there (and of course, files which aren’t provided by a package). However the map described above also works to find keys which are no longer used in your setup.

Starting with APT 2.4, it will be possible to specify signing keys in .sources snippets, e.g.

URIs: https://deb.debian.org
Suites: stable
Components: main contrib non-free
Signed-By:
 -----BEGIN PGP PUBLIC KEY BLOCK-----
...
 -----END PGP PUBLIC KEY BLOCK-----