How can I list all installed packages along with their APT origin hostnames (not their origin tags)?

Question

I'm trying to limit the risk in using third-party APT repositories. The scenario I'm trying to protect against is a malicious package being introduced into a third-party repo with a newer version than the version I have installed from Debian.

Lately whenever I've added a new APT source, I've used APT pinning to make only certain packages installable from that source, like so:

Package: *
Pin: origin debian.nabijaczleweli.xyz
Pin-Priority: -1

Package: systemd-zram
Pin: origin debian.nabijaczleweli.xyz
Pin-Priority: 500

Note that I am using Pin: origin <hostname> rather than Origin: <tag> to do this. If I understand correctly, the origin tag is controlled by the repo itself (in the Releases file) and can easily be set to debian, either maliciously or because of ignorance. (I have seen this in the wild.) By contrast, the origin hostname is derived from the URI specified in sources.list.

This seems to work just fine, and now I want to apply this to all my third-party APT sources. To do this, I need to know which packages I've installed from each third-party repository. The problem is, I can't seem to find a way to get a list of installed packages and their origin URIs or hostnames.

Aptitude is happy to show you Origin URI on its package information screen¹, but does not include a search predicate for it nor will it display it in package lists.

dpkg-query and apt-cache can give me a lot of information about packages, but I haven't yet found a way to get the origin URI or hostname.

I assume I could parse the contents of /var/lib/apt/lists/*_Packages myself, using the first part of the filename as the origin hostname, but I'd prefer not to subject myself to that.

So:

1. Is this scenario even worth considering? Maybe there are so many ways that a compromised repo can screw me over that I should learn to stop worrying and love the bomb.

2. Am I correct that the Releases file's Origin field is less reliable an indication of a package's provenance than the origin hostname used in Pin: origin <hostname>?

3. Is there a way to get a list of all installed packages along with their origin hostnames?

Thanks!

¹The screenshot on that page is too old to depict the Origin-URI field being shown, but modern versions of Aptitude show the complete URI of the package here.

Answer 1

Seems aptitude is dumb... for the logic you want.

A workaround is to resort to Python:

import apt

CACHE = apt.Cache()

for pkg in CACHE:
    if not pkg.installed:
        continue
    for orig in pkg.candidate.origins if pkg.candidate else []:
        if len(orig.site) == 0:
            continue
        print(pkg, pkg.candidate.version, orig.site)

UPDATE The package apt comes with:

bash# dpkg -S /usr/lib/python3/dist-packages/apt/__init__.py
python3-apt: /usr/lib/python3/dist-packages/apt/__init__.py