sign the repository at ddebs.ubuntu.com

[Louis-Dominique Dubeau]

The repository at ddebs.ubuntu.com is currently not signed. Even if the server is well secured, a man-in-the-middle attack could cause someone to install tainted packages on their system.

[Chris Sherlock (ta-bu-shi-da-yu)]

Is there any reason why this cannot be done? Currently this is preventing me from doing a partial upgrade of my system. I can certainly remove the repo from my sources, but that isn't going to help with testing.

[Chris Sherlock (ta-bu-shi-da-yu)]

Hi all, what would need to be done to get something done about this?

[Pär Lindfors (paran)]

"Reported on 2008-01-24" and not a single response from any ubuntu developer or Security Team member about this?

All packages are built on the normal build servers. I really can't see any reason for it to be hard to get ddebs.ubuntu.com signed, either by the standard archive key or a separate one.

Two big problems with the current situation:

1. Many Ubuntu developers is probably using ddebs.ubuntu.com. I really don't like developers of the distribution I use to get malicious packages installed.

2. Users will be told to enable this repository to help triage bugs. This teaches them that it is OK to ignore security warnings from APT.

The second problem is of course the same when using PPAs. But there the problem is harder to solve, and is beeing discussed in bug #125103.

[Chris Sherlock (ta-bu-shi-da-yu)]

Don't forget however that if you do a distro update you need to remember to disable the ddebs source because they are unsigned and the distro update will fail.

I guess that's more a usability issue than anything though.

[Martin Pitt (pitti)]

For the record, I'm currently working on getting them signed, I have to fix my scripts to produce proper Release files, though.

[Chris Sherlock (ta-bu-shi-da-yu)]

Excellent! I think we all appreciate the status update. :-)

[Martin Pitt (pitti)]

Sorry again for the delay. It's done now, apt-get update and apt-get install now don't complain any more.

I created a key for this:

pub 1024D/428D7C01 2008-09-02
uid Ubuntu Debug Symbol Archive Automatic Signing Key <email address hidden>
sub 2048g/A2C2A7A5 2008-09-02

I put it at http://ddebs.ubuntu.com/dbgsym-release-key.asc and also uploaded it to keyserver.ubuntu.com.

The key is currently signed with my own GPG key only.

To import it:
 gpg --keyserver keyserver.ubuntu.com --recv-key 428D7C01
 gpg --check-sigs 428D7C01 # make sure that you only get "sig!", not - or %
 gpg --export 428D7C01 | sudo apt-key add -

[Chris Sherlock (ta-bu-shi-da-yu)]

Thank you!!!!

[Rich (rincebrain)]

Excellent, thank you. :)