23

I looked at another similar question about adding third-party repos. I am trying to add a third-party desktop IM client called riot . While the site gives link to the third-party it gives no instructions as how to add third-party sources or keyring in Debian. I went through https://riot.im/packages/debian/pool/main/ and made the following additions in my /etc/apt/sources.list -

######## Third party repos #######
deb https://riot.im/packages/debian/ stretch main

Now I have two questions :-

a. Is the third-party repo. I have entered is correct or should I ask for more information from upstream.

b. How do I add the secure key as all packages are usually signed in the Debian Universe. The public key is given at https://riot.im/packages/debian/repo-key.asc

I am on Debian stretch/testing.

Community
  • 1
shirish
  • 12,356

2 Answers2

52

You must NEVER install any 3rd party key with apt-key add, as suggested in other posts, because it would cause the system to accept signatures from the third-party keyholder on all other repositories configured on the system. You should set up the repository and install the key as follows:

  1. Create directory for manually installed OpenPGP keys:

    $ sudo mkdir /usr/local/share/keyrings

  2. Download the key into the directory.

    Since your key’s extension is .asc, it is probably "ascii-armored" (you can check this by downloading they key and opening it in a text editor: if it starts with something like

    -----BEGIN PGP PUBLIC KEY BLOCK-----

    then it is armored; if it looks like a set of some binary data, then it is not armored and you can use it as it is):

    • for an armored key:

      $ curl https://riot.im/packages/debian/repo-key.asc | gpg --dearmor | sudo dd of=/usr/local/share/keyrings/riot-archive-keyring.gpg

    • If the key is not armored, then use this command instead:

      $ sudo wget -O /usr/local/share/keyrings/riot-archive-keyring.gpg https://riot.im/packages/debian/repo-key.asc

  3. Add the desired 3rd party repository into the list of sources (pay attention to the signed-by option, it tells APT that the repo is signed with the specific key):

    • It is recommended to use the new deb822 multiline format for sources now. So create new .sources file with the respective content below:

      $ sudoedit /etc/apt/sources.list.d/riot.sources

      Types: deb
URIs: https://riot.im/packages/debian/
Suites: stretch
Components: main
Signed-By: /usr/local/share/keyrings/riot-archive-keyring.gpg

    • Or if you prefer the legacy style (one line per source), use this command instead::

      $ echo "deb [signed-by=/usr/local/share/keyrings/riot-archive-keyring.gpg] https://riot.im/packages/debian/ stretch main" | sudo tee -a /etc/apt/sources.list.d/riot.list

  4. Restrict the 3rd party repository to some specific software package only. Create preference control file for APT:

    $ sudoedit /etc/apt/preferences.d/riot.pref

  5. Put the following content into the file (if necessary, you can append the package name with asterisk (*) as a wildcard or list multiple package names separated by space ():

    Package: *
Pin: origin riot.im
Pin-Priority: 1

Package: riot-web
Pin: origin riot.im
Pin-Priority: 500

You can find official information from Debian here: https://wiki.debian.org/DebianRepository/UseThirdParty

Trudy
  • 854
  • 4
    Is there a sensible way to do this automatically, because it would be a massive annoyance to do it laboriously like this every time we add a 3rd-party repository. Only two out of 18 of the 3rd party repos I'm using have done it in this more secure way.

    Also, we need a script to undo the damage for the repos that have already been added, and put the keys where they should be.

    I guess I'm going to have to roll up my sleeves and write that script, eh?

     – Sam Watkins May 24 '21 at 16:32
  • @SamWatkins: 1. This is a custom sysadmin operation. it cannot be automated, because no two people ever want the same thing from such automation. 2. What do you mean with repos doing it in this way? Repos don't install keys, .deb packages can. If this is what you wander about, then you can check this (unanswered) question. 3. The benefit of the open-source SW is that you can propose new things, especially if you contribute with your own code. Try to propose your script to a SW, you think it fits to. – Trudy Jul 11 '21 at 18:31
  • This answer leads to a false sense of security. "You must NEVER install any 3rd party key" appears to imply that the proposed solution removes risks when using an untrusted archive. It does not. You still have to trust the archive not to contain malicious code. – Federico Aug 02 '21 at 13:32
  • 2
    @Frederico, it depends on what attack vector you are concerned of. If you don't trust this specific package in this specific repo, then you are better not to install it at all. "You must NEVER install any 3rd party key" implies that you shall not expose your system more than needed. The answer definitely doesn't (and cannot) ensure 360 degrees security on your system, and it doesn't imply so. – Trudy Aug 03 '21 at 06:56
  • 3
    The [signed-by] option limits the damage when a repo's keys are compromised; the key cannot be used to forge packages unrelated to the repo and limits the damage done. Installing a key in the global keyring means that any packages signed by that key are trusted, even though it makes no sense for that to happen. – Nelson Nov 11 '21 at 09:55
  • Is step 5 wrong/outdated? The linked Debian doc says "The Pin-Priority field MAY be set so that packages are upgraded by default (Pin-Priority: 100) or not (Pin-Priority: 1) but it MUST NOT be set to any higher value that may lead to overwriting packages shipped with the default Debian distribution." This implies that Pin-Priority=500 is too high. Also, lower in the doc in the Complete Example section, it indicates that doing Pin-Priority=100 for all packages is the only step needed. Perhaps I misunderstand? – PunctualEmoticon Sep 18 '23 at 17:02
  • @PunctualEmoticon, Pin-Priority=500 tells to prefer 3rd party repo over packages delivered by Debian. Debian guide suggests not to set it above 100 so that to always prefer Debian packages. It is up to your preference, but it is not wrong. Another debian doc suggests to set 500 so that to force installation from your own repo. – Trudy Sep 20 '23 at 14:50
7

To add the key run:

wget https://riot.im/packages/debian/repo-key.asc
sudo apt-key add repo-key.asc

The third-party repo is correct and compatible with the general format posted on debian wiki:

The entries in this file normally follow this format:

deb http://site.example.com/debian distribution component1 component2 component3
GAD3R
  • 66,769