Lesson 5.45: APT repository trust and pinning
Every APT repository you add can replace any package on the machine, because APT simply installs the highest-priority, newest version it finds. A repository marked [trusted=yes] skips signature checks entirely, and a key dropped into trusted.gpg.d is trusted for every repository at once. In the lab a vendor repository added for one monitoring agent is quietly offering its own nginx and openssl. You find the unsigned source, bind its key to that repository alone with signed-by, and pin it so it can supply its agent and nothing else.
18 min
You will learn to
- Explain why trusted=yes and trusted.gpg.d are dangerous
- Read apt-cache policy: priorities, candidates and version tables
- Bind a repository key with signed-by
- Limit a third-party repository with APT pinning
- Verify the candidate versions after the change
Key terms
- trusted=yes
- A source option that makes APT accept the repository without a valid signature.
- signed-by
- Binds a repository to one key file; the key is not trusted for any other source.
- trusted.gpg.d
- The old global keyring directory: a key there is accepted for every repository.
- Pin priority
- A number APT uses to choose between versions: 500 default, 100 installed, 990 target release, above 1000 allows downgrades.
- Candidate
- The version apt install or upgrade would choose right now.
← Finding the bottleneck · All lessons · Scanning against a benchmark with OpenSCAP →