4.5 Package Repositories & Integrity Verification (102.4/102.5)

4.5 Package Repositories & Integrity Verification (102.4/102.5)

Quick Summary: Software repositories are centralized network storage locations containing binary packages, source code, and cryptographically signed metadata indexes. To ensure supply chain security, both Debian and Red Hat ecosystems implement asymmetric GPG (GNU Privacy Guard) public-key cryptography. This architecture ensures that package managers download software only from authentic origin servers and guarantees that packages have not been tampered with or corrupted in transit.

---

1. Debian Repository Configuration (sources.list)

In Debian, Ubuntu, and derivative distributions, repository locations are defined in /etc/apt/sources.list and modular files ending in .list under /etc/apt/sources.list.d/.

   deb   [arch=amd64 signed-by=...]   http://deb.debian.org/debian/   bookworm   main contrib non-free
  └──┬┘ └────────────┬───────────┘   └──────────────┬──────────────┘ └───┬────┘ └──────────┬───────────┘
 Type             Options                         URI                 Suite        Components

Debian Repository Line Structure

1. Archive Type (type):
   • deb: Indicates a repository providing compiled binary .deb packages.
   • deb-src: Indicates a repository providing Debian source packages (.dsc, .orig.tar.gz, .diff.gz).
2. Options ([options]): Optional bracketed parameters (e.g., [arch=amd64], [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg]).
3. URI (uri): The base URL, FTP address, or local path (file:/...) of the repository.
4. Distribution Suite / Codename (distribution): The target release suite (e.g., stable, testing, unstable) or release codename (e.g., bookworm, bullseye, jammy).
5. Components (components): Software classification sections categorized by licensing and support:
   • main: 100% DFSG-compliant (Debian Free Software Guidelines) software that requires no non-free dependencies.
   • contrib: DFSG-compliant open-source software that depends on proprietary or non-free packages.
   • non-free: Proprietary software or software containing licensing restrictions.
   • non-free-firmware: Introduced in Debian 12 (Bookworm) to isolate closed-source binary firmware blobs for network and GPU hardware.

# Sample /etc/apt/sources.list for Debian 12 Bookworm
deb http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
deb http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
deb http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware

---

2. Debian Cryptographic Verification & Modern Keyrings

Debian package integrity relies on a cryptographic chain of trust:

1. The repository maintains a Release metadata file listing SHA256 checksums for all Packages.gz index files.
2. The repository signs the Release file with a private GPG key, generating an InRelease or Release.gpg detached signature.
3. APT downloads the signature, validates it against the trusted local public GPG keyring, and verifies that individual downloaded .deb files match the SHA256 digests in Packages.gz.

The Deprecation of apt-key & Modern Best Practices

Historically, administrators added repository signing keys using apt-key add key.gpg. This practice is deprecated because apt-key placed all keys into a single global keyring (/etc/apt/trusted.gpg), allowing a compromised key from a third-party repository to sign packages for official core system repositories.

Modern Keyring Standard:

• GPG public keys are stored as isolated binary keyring files under /usr/share/keyrings/ or /etc/apt/keyrings/.
• The repository line in sources.list explicitly references its specific key using the signed-by option:

# 1. Download and de-armor the GPG key into an isolated keyring file
curl -fsSL https://packages.example.com/gpg.key | gpg --dearmor | sudo tee /usr/share/keyrings/example-keyring.gpg > /dev/null

# 2. Reference the isolated keyring in /etc/apt/sources.list.d/example.list
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/example-keyring.gpg] https://packages.example.com/deb stable main" | sudo tee /etc/apt/sources.list.d/example.list

---

3. RPM Repository Configuration (.repo Files)

In RHEL, CentOS, Fedora, and openSUSE, repository definitions reside in /etc/yum.repos.d/ as individual files ending in .repo. Each file uses standard INI syntax containing one or more repository sections.

[baseos]
name=Rocky Linux $releasever - BaseOS
baseurl=http://dl.rockylinux.org/pub/rocky/$releasever/BaseOS/$basearch/os/
# mirrorlist=https://mirrors.rockylinux.org/mirrorlist?arch=$basearch&repo=BaseOS-$releasever
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
priority=1

Core Directives in .repo Files

Variable Expansion in .repo Files

• $releasever: Replaced by the OS major/minor release version (e.g., 9).
• $basearch: Replaced by the system base CPU architecture (e.g., x86_64, aarch64).
• $arch: Replaced by the exact CPU architecture (e.g., i686).

---

4. RPM Key Management & Package Signature Checking

RPM stores imported GPG public keys in its internal database (/var/lib/rpm/) formatted as pseudo-packages named gpg-pubkey.

# Import an official vendor GPG public key into the RPM database
$ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-Rocky-9
# OR import directly over HTTPS
$ sudo rpm --import https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-9

# Query all imported GPG public keys
$ rpm -qa "gpg-pubkey*"
gpg-pubkey-350d275d-62423f66
gpg-pubkey-8483c65d-5ccc5b19

# Inspect metadata and fingerprint of an imported key
$ rpm -qi gpg-pubkey-350d275d-62423f66

Package Integrity & Signature Verification with rpm -K

The rpm -K (or rpm --checksig) command checks the cryptographic signature and digest hashes of an uninstalled .rpm package file before allowing installation.

# Verify cryptographic signatures and SHA256 digests
$ rpm -K httpd-2.4.51-1.el9.x86_64.rpm
httpd-2.4.51-1.el9.x86_64.rpm: digests signatures OK

# Check only digests while skipping GPG signature verification
$ rpm -K --nogpg httpd-2.4.51-1.el9.x86_64.rpm

# Check only GPG signatures while skipping checksum digests
$ rpm -K --nodigest httpd-2.4.51-1.el9.x86_64.rpm

💡 LPIC-1 Exam Fill-in-the-Blank Alert: When asked for the command and flag to import a GPG public key into the RPM database, the answer is rpm --import <key_file>. When asked for the command to check the cryptographic signature of an RPM archive file, the answer is rpm -K <file.rpm> (or rpm --checksig).