Debian keys should not be trusted by default

Bug #1685305 reported by Dimitri John Ledkov on 2017-04-21
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
debian-archive-keyring (Ubuntu)
Undecided
Unassigned
Trusty
Undecided
Unassigned
Xenial
Undecided
Unassigned
Yakkety
Undecided
Unassigned
Zesty
Undecided
Unassigned
Artful
Undecided
Unassigned

Bug Description

[Impact]

 * debian-archive-keyring provides Debian Archive keys in two formats/locations:
   - /usr/share/keyrings/debian-archive-keyring.gpg
   - /etc/apt/trusted.gpg.d/*.gpg snippets

   The first location is used by many development tools to validate Debian
   mirrors when creating chroots/containers of Debian releases.

   The latter one is used by apt to validate and trust repositories.

   Ubuntu and Debian releases are, often, binary incompatible with each other,
   therefore by default on Ubuntu systems apt should not trust Debian Archive keys,
   when one simply wants to have ability to verify Debian releases on a Ubuntu system.

   Furthermore, debian-archive-keyring is often not installed explicitly but pulled in
   as a dependency. Thus the presence of debian-archive-keyring cannot be treated as
   consent to trust Debian archive keys by default.

[Test Case]

 * Install debian-archive-keyring
 * Verify that Debian keys are listed in the output of $ apt-key list
 * Upgrade debian-archive-keyring
 * Verify that Debian keys are no longer present in the output of $ apt-key list

[Regression Potential]

 * Users that rely on hosts' system to trust Debian archive keys, will no longer do.
 * As a workaround those users should symlink
   /usr/share/keyrings/debian-archive-keyring.gpg into /etc/apt/trusted.gpg.d/
 * Maybe we should provide a package "debian-archive-keyring-trusted" which will
   ship the trusted.gpg.d snippets and make host systems trust Debian keys. But I
   do not believe there is a demand for that.

Dimitri John Ledkov (xnox) wrote :
description: updated
description: updated
tags: added: patch
no longer affects: debian-archive-keyring (Ubuntu Vivid)
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers