APT Signing Key Folders and Other Development Notes

From Kicksecure
< Dev
Jump to navigation Jump to search

/etc/apt/trusted.gpg, /etc/apt/trusted.gpg.d, /usr/share/keyrings

APT Keyring Folders[edit]

APT by default considers only signing keys in:

  • file /etc/apt/trusted.gpg
  • folder /etc/apt/trusted.gpg.d

Signing keys in folder /usr/share/keyrings are ignored by default by APT, unless the signed-by keyword is used in APT sources files (i.e. in configuration file /etc/apt/sources.list or in configuration snippet drop-in folder /etc/apt/sources.list.d).

Example signed-by keyword use:


Example of complete deb line with signed-by keyword.

deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bullseye main contrib non-free

Repository Migration[edit]

Which project and which version comes with which repositories enabled by default?[edit]

  • Kicksecure builds earlier than version come with: deb.whonix.org
  • Kicksecure builds version come with: deb.kicksecure.com
  • Whonix builds earlier than version come with: deb.whonix.org
  • Whonix builds version come with: deb.kicksecure.com + deb.whonix.org

Which repositories contain what packages?[edit]

  • Legacy:
    • 16 and below: Mixing. Legacy. For migration purposes. Both, deb.kicksecure.com and deb.whonix.org contain all packages, i.e. contain both, all Kicksecure and all Whonix packages.
  • Future:

changed its 'Origin' value from 'whonix' to 'kicksecure'[edit]

https://github.com/Kicksecure/derivative-maker/blob/master/aptrepo_remote/kicksecure/conf/distributionsarchive.org is still using old Origin and Label values. This is to avoid the following error during "sudo apt update".

E: Repository 'tor+https://deb.kicksecure.com bullseye InRelease' changed its 'Origin' value from 'whonix' to 'kicksecure'
E: Repository 'tor+https://deb.kicksecure.com bullseye InRelease' changed its 'Label' value from 'Whonix' to 'Kicksecure'
N: This must be accepted explicitly before updates for this repository can be applied. See apt-secure(8) manpage for details.
  • This is avoid users updates getting more complicated by seeing above error message and needing to use sudo apt update --allow-releaseinfo-change to resolve it.
  • Origin and Label needs to be to be changed in Kicksecure 17 in above file once the Kicksecure repository for Debian bookworm based becomes available. This will be done during Release Upgrade.

Why does Kicksecure use Origin whonix?[edit]

  • version 16 and below: For legacy compatibility.
    • Technical detail: For the longest time, for most users deb.kicksecure.com was a mirror of deb.whonix.org. Hence used Origin whonix. To keep the amount of user confusion lowest, fewest users being affected it was decided to keep it that way until the release upgrade for version 16 (Debian Origin based) becomes available. Unfortunately those users who upgraded fastest saw the `Origin`/`Label` change.
  • version 17 above: No more legacy. Kicksecure will use Origin kicksecure.

Background on Debian APT Origin and Label[edit]

When Debian's APT sees for the first time a repository, it notes its Origin and Label fields. Should these change, Debian will show a warning/question and not proceed using any repository with a changed Origin or Label until the user accepts the change using sudo apt update --allow-releaseinfo-change.

Forum Discussion[edit]


See Also[edit]

Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!