Ubuntu – Does apt-get automatically check digital signatures

aptSecurityserver

I am planning to run a production server on Ubuntu LTS 8.04 and I am concerned about security of the packages I am installing I want to make sure that packages that are downloaded by apt-get were not tampered with.

How do I view the digital signatures associated with a package in ubuntu?
Does apt-get install, apt-get update, apt-get upgrade automatically check digital signatures when downloading, installing packages or do I need to pass a command line option for these checks to happen?
Who am I trusting when I install a package using apt-get install assuming that the package is part of the ubuntu main distribution, am I trusting canonical, debian, or an open source contributor?

Best Answer

You are trusting that canonical compiled the program so it did not have any tampering that is not evident in the source code, and that they verified the signature on the source code from the ubuntu developer that uploaded it, or that debian did the same for the debian developer who uploaded it, if the package came from debian. You are trusting the developer who uploaded the source package, who of course, can not thoroughly review all of the upstream code, so you are also trusting all of the upstream open source contributors.

Example

Create a simple application in Kotlin that displays Hello, World!. Create a new file with executable permission called hello.kt with the following:
```
fun main(args: Array<String>) {
    println("Hello, World!")
}
```

Compile the application using the Kotlin compiler.

kotlinc hello.kt -include-runtime -d hello.jar

Run the application.
```
java -jar hello.jar
```

Ubuntu – Unable to locate package libgstreamer0.10-dev on Ubuntu 18.04

libgstreamer0.10-dev is outdated in Ubuntu 18.04.

So, use newer version instead:

sudo apt install -y libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev

This will surely work.

Best Answer

Related Solutions

Ubuntu – Installing Kotlin securely, with package signatures, auto-update etc

Example

Ubuntu – Unable to locate package libgstreamer0.10-dev on Ubuntu 18.04

Related Question