12

I went on to download an application today. It had it's instructions listed, step by step, number one being: adding a GPG-key with apt-key. It was followed by adding the application to apt/sources and finally downloading it with apt-get install.

I can't get my head around the need of adding a key, before downloading an application after adding the URL to sources.

Why do I need to add a GPG-key with apt-key before adding a download URL to apt/sources and downloading-installing with apt-get install?

1 Answer 1

9

Why do I need to add a GPG-key with apt-key before adding a download URL to apt/sources and downloading-installing with apt-get install?

The reason is simple: security.

First, if you don't do this, apt-get update will whine that some keys aren't found, and it downloaded "untrusted" package lists. If you do apt-get install it will ask you twice with big letters that you are installing packages from a untrusted sources. To any user this warning would be alarming (if they read them), so to prevent "How to solve 'NOPUBKEY' found" and similar questions, repository owners often include how to add their keys before even starting so users don't miss this step.

Second, if you miss this step and ignore the warning, the security is incomplete. You downloaded some packages list from a site you didn't verify. Any crack could have been exploited by someone, then tricking you into installing malicious software. If you added the keys since the start, you will have start-to-end secure transactions with the repository maintainer.

Third, when you add a key, it means that you trust that key. You say the system that you trust the person that identify themself with that key, and you want to install software from him.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.