APT Signing Key Folders and Other Development Notes

From Kicksecure
< Dev
Jump to navigation Jump to search

/etc/apt/trusted.gpg, /etc/apt/trusted.gpg.d, /usr/share/keyrings

APT Keyring Folders[edit]

APT by default considers only signing keys in:

  • file /etc/apt/trusted.gpg
  • folder /etc/apt/trusted.gpg.d

Signing keys in folder /usr/share/keyrings are ignored by default by APT, unless the signed-by keyword is used in APT sources files (i.e. in configuration file /etc/apt/sources.list or in configuration snippet drop-in folder /etc/apt/sources.list.d).

Example signed-by keyword use: 

[signed-by=/usr/share/keyrings/derivative.asc]

Example of complete deb line with signed-by keyword. 

deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bullseye main contrib non-free

Repository Migration[edit]

Which project and which version comes with which repositories enabled by default?[edit]

  • Kicksecure builds earlier than version 16.0.5.0 come with: deb.whonix.org
  • Kicksecure builds version 16.0.5.0 come with: deb.kicksecure.com
  • Whonix builds earlier than version 16.0.5.0 come with: deb.whonix.org
  • Whonix builds version 16.0.5.0 come with: deb.kicksecure.com + deb.whonix.org

Which repositories contain what packages?[edit]

  • Legacy:
    • 16 and below: Mixing. Legacy. For migration purposes. Both, deb.kicksecure.com and deb.whonix.org contain all packages, i.e. contain both, all Kicksecure and all Whonix packages.
  • Future:

changed its 'Origin' value from 'whonix' to 'kicksecure'[edit]

https://github.com/Kicksecure/derivative-maker/blob/master/aptrepo_remote/kicksecure/conf/distributionsarchive.org iconarchive.today icon is still using old Origin and Label values. This is to avoid the following error during "sudo apt update". 

E: Repository 'tor+https://deb.kicksecure.com bullseye InRelease' changed its 'Origin' value from 'whonix' to 'kicksecure'
E: Repository 'tor+https://deb.kicksecure.com bullseye InRelease' changed its 'Label' value from 'Whonix' to 'Kicksecure'
N: This must be accepted explicitly before updates for this repository can be applied. See apt-secure(8) manpage for details.
  • This is avoid users updates getting more complicated by seeing above error message and needing to use sudo apt update --allow-releaseinfo-change to resolve it.
  • Origin and Label needs to be to be changed in Kicksecure 17 (actually 18) in above file once the Kicksecure repository for Debian bookworm based becomes available. This will be done during Release Upgrade.

Why does Kicksecure use Origin whonix?[edit]

  • version 16 and below: For legacy compatibility.
    • Technical detail: For the longest time, for most users deb.kicksecure.com was a mirror of deb.whonix.org. Hence used Origin whonix. To keep the amount of user confusion lowest, fewest users being affected it was decided to keep it that way until the release upgrade for version 16 (Debian Origin based) becomes available. Unfortunately those users who upgraded fastest saw the `Origin`/`Label` change.
  • version 17 above: No more legacy. Kicksecure will use Origin kicksecure.

Background on Debian APT Origin and Label[edit]

When Debian's APT sees for the first time a repository, it notes its Origin and Label fields. Should these change, Debian will show a warning/question and not proceed using any repository with a changed Origin or Label until the user accepts the change using sudo apt update --allow-releaseinfo-change.

Forum Discussion[edit]

https://forums.whonix.org/t/e-repository-tor-https-deb-kicksecure-com-bullseye-inrelease-changed-its-origin-value-from-kicksecure-to-whonix/13810archive.org iconarchive.today icon

See Also[edit]

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Dev/APT&oldid=85389"