Difference between using or not using a GPG key for installing software from a repository
Clash Royale CLAN TAG#URR8PPP up vote
1
down vote
favorite
Okay, as far as I've researched, to install software from a repository an identification key is used to sign a file (not encrypt it). We get the public key and the maintainer of the repo has the private key. The private key is used to sign a file and the public key is used to validate the authenticity of them.
So we need to register both the repo and the public key in our system.
But there are some cases where you just register the repo without the need of a public key and you can download packages from those repos.
Well, that's what I've understood so far.
For example:
To install MSSQL you need to register the repo as well as the public key.
But with NodeJS you just register the repo.
So what's the difference between using or not using a key? I know that it is to make sure that I'm getting the package from where I think I'm getting it from, but how does the system validate those packages coming from those registered repos with the keys registered in our system?
Basically, what's the workflow? That's what I'm trying to understand.
16.04 apt gnupg
edited Jun 6 at 14:42
unor
407321
asked Jun 5 at 16:03
RottenCheese
61
add a comment |Â
up vote
1
down vote
favorite
Okay, as far as I've researched, to install software from a repository an identification key is used to sign a file (not encrypt it). We get the public key and the maintainer of the repo has the private key. The private key is used to sign a file and the public key is used to validate the authenticity of them.
So we need to register both the repo and the public key in our system.
But there are some cases where you just register the repo without the need of a public key and you can download packages from those repos.
Well, that's what I've understood so far.
For example:
To install MSSQL you need to register the repo as well as the public key.
But with NodeJS you just register the repo.
So what's the difference between using or not using a key? I know that it is to make sure that I'm getting the package from where I think I'm getting it from, but how does the system validate those packages coming from those registered repos with the keys registered in our system?
Basically, what's the workflow? That's what I'm trying to understand.
16.04 apt gnupg
edited Jun 6 at 14:42
unor
407321
asked Jun 5 at 16:03
RottenCheese
61
Exactly which repos supposedly don't need a public key?
– user535733
Jun 5 at 16:48
To answer your title only--In layman's terms they are passwords.
– WinEunuuchs2Unix
Jun 5 at 21:44
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
Okay, as far as I've researched, to install software from a repository an identification key is used to sign a file (not encrypt it). We get the public key and the maintainer of the repo has the private key. The private key is used to sign a file and the public key is used to validate the authenticity of them.
So we need to register both the repo and the public key in our system.
But there are some cases where you just register the repo without the need of a public key and you can download packages from those repos.
Well, that's what I've understood so far.
For example:
To install MSSQL you need to register the repo as well as the public key.
But with NodeJS you just register the repo.
So what's the difference between using or not using a key? I know that it is to make sure that I'm getting the package from where I think I'm getting it from, but how does the system validate those packages coming from those registered repos with the keys registered in our system?
Basically, what's the workflow? That's what I'm trying to understand.
16.04 apt gnupg
edited Jun 6 at 14:42
unor
407321
asked Jun 5 at 16:03
RottenCheese
61
Okay, as far as I've researched, to install software from a repository an identification key is used to sign a file (not encrypt it). We get the public key and the maintainer of the repo has the private key. The private key is used to sign a file and the public key is used to validate the authenticity of them.
So we need to register both the repo and the public key in our system.
But there are some cases where you just register the repo without the need of a public key and you can download packages from those repos.
Well, that's what I've understood so far.
For example:
To install MSSQL you need to register the repo as well as the public key.
But with NodeJS you just register the repo.
So what's the difference between using or not using a key? I know that it is to make sure that I'm getting the package from where I think I'm getting it from, but how does the system validate those packages coming from those registered repos with the keys registered in our system?
Basically, what's the workflow? That's what I'm trying to understand.
16.04 apt gnupg
edited Jun 6 at 14:42
unor
407321
asked Jun 5 at 16:03
RottenCheese
61
edited Jun 6 at 14:42
unor
407321
edited Jun 6 at 14:42
unor
407321
edited Jun 6 at 14:42
unor
407321
407321
asked Jun 5 at 16:03
RottenCheese
61
asked Jun 5 at 16:03
RottenCheese
61
asked Jun 5 at 16:03
RottenCheese
61
61
Exactly which repos supposedly don't need a public key?
– user535733
Jun 5 at 16:48
To answer your title only--In layman's terms they are passwords.
– WinEunuuchs2Unix
Jun 5 at 21:44
add a comment |Â
Exactly which repos supposedly don't need a public key?
– user535733
Jun 5 at 16:48
To answer your title only--In layman's terms they are passwords.
– WinEunuuchs2Unix
Jun 5 at 21:44
Exactly which repos supposedly don't need a public key?
– user535733
Jun 5 at 16:48
Exactly which repos supposedly don't need a public key?
– user535733
Jun 5 at 16:48
To answer your title only--In layman's terms they are passwords.
– WinEunuuchs2Unix
Jun 5 at 21:44
To answer your title only--In layman's terms they are passwords.
– WinEunuuchs2Unix
Jun 5 at 21:44
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1043856%2fdifference-between-using-or-not-using-a-gpg-key-for-installing-software-from-a-r%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Exactly which repos supposedly don't need a public key?
– user535733
Jun 5 at 16:48
To answer your title only--In layman's terms they are passwords.
– WinEunuuchs2Unix
Jun 5 at 21:44