Ubuntu – How to securely retrieve ubuntu kernel source code

aptgitkernelsource code

According to BuildYourOwnKernel there are two ways to get the source code:

apt-get

  • Is apt-get signed by the Ubuntu team?
  • I mean, will my computer verify the signature when I download it?
  • Is there a way I can verify myself the signature with an alternative method?

git

Git source code is not signed.

  • Is there a place where I can find the signature?
  • I can see that git tags are signed, but I can't get the public keys and neither can I verify that these public keys are secure (are they signed by the Ubuntu team?)

Best Answer

Is apt-get signed by the ubuntu team?

Well, the dsc file is signed and contains hashes of the files to be downloaded:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.0
Source: linux
...
Checksums-Sha1:
 180ab617036593212274177eff3a67f437c1b5ea 132860730 linux_4.4.0.orig.tar.gz
 be23819008464f4aa49bed094d19aac086f16572 13880183 linux_4.4.0-112.135.diff.gz
Checksums-Sha256:
 730e75919b5d30a9bc934ccb300eaedfdf44994ca9ee1d07a46901c46c221357 132860730 linux_4.4.0.orig.tar.gz
 b5b6adc87ea98ffa48d31aee2ee5ec301a01c2b4fa64fa20d1564a4e95bdd6ad 13880183 linux_4.4.0-112.135.diff.gz
Files:
 2070b49688e8d7ee7ff4c33590afc698 132860730 linux_4.4.0.orig.tar.gz
 b349ae228d1659789e713b8ff2262eac 13880183 linux_4.4.0-112.135.diff.gz

So a signed dsc file with checksums of the tarballs in it ~ closest you'll get to signed source code.

I mean, will my computer verify the signature when I download it?

It does try. apt-get does attempt to verify it:

$ apt-get source linux-image-4.4.0-87-generic
Reading package lists... Done
Picking 'linux' as source package instead of 'linux-image-4.4.0-87-generic'
NOTICE: 'linux' packaging is maintained in the 'Git' version control system at:
git://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/xenial
Please use:
git clone git://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/xenial
to retrieve the latest (possibly unreleased) updates to the package.
Need to get 147 MB of source archives.
Get:1 ftp://ftp.iitb.ac.in//os/ubuntu/archives/ubuntu xenial-security/main linux 4.4.0-112.135 (dsc) [9,712 B]
Get:2 ftp://ftp.iitb.ac.in//os/ubuntu/archives/ubuntu xenial-security/main linux 4.4.0-112.135 (tar) [133 MB]
Get:3 ftp://ftp.iitb.ac.in//os/ubuntu/archives/ubuntu xenial-security/main linux 4.4.0-112.135 (diff) [13.9 MB]
Fetched 147 MB in 4s (31.8 MB/s)
gpgv: Signature made Fri 19 Jan 2018 17:14:04 IST using RSA key ID CBEECEA3
gpgv: Can't check signature: public key not found
dpkg-source: warning: failed to verify signature on ./linux_4.4.0-112.135.dsc
dpkg-source: info: extracting linux in linux-4.4.0
dpkg-source: info: unpacking linux_4.4.0.orig.tar.gz
dpkg-source: info: applying linux_4.4.0-112.135.diff.gz
dpkg-source: info: upstream files that have been modified:

But in my case it didn't succeed because I hadn't imported the corresponding key yet. The dsc files are usually signed by the developer who created it, and AFAICT there is no single place where all such keys are listed. The various Ubuntu developers are members of various groups on Launchpad, and the Launchpad profiles of the developers should list their GPG keys. For example, see the Ubuntu Kernel Uploaders team, or the combined Ubuntu Developers team (which in turn includes many other teams).

In this specific case, the signer is Canonical employee Stefan Bader. You can fetch the key from the Ubuntu keyserver, but you might want to do so using HKPS.

Is there a way I can verify myself the signature with an alternative method?

The dscverify tool can be used for that.

I can see that git tags are signed, but I can't get the public keys and neither can I verify that these public keys are secure (are they signed by the Ubuntu team?)

Well, going by Stefan Bader's or Andy Whitcroft's (who seems to have signed this tag, for example) keyserver listings, yes.

Related Question