오늘 데비안을 설치하면서 흥미로운 사실을 발견했습니다. 예를 들어 내가 그렇게 한다면
$ apt-key list
/etc/apt/trusted.gpg
--------------------
pub rsa4096 2019-04-15 [SC] [expires: 2024-04-13]
12D4 CD60 0C22 40A9 F4A8 2071 D7B0 B669 41D0 1538
uid [ unknown] riot.im packages <[email protected]>
sub rsa3072 2019-04-15 [S] [expires: 2021-04-14]
pub rsa4096 2019-04-15 [SC] [expires: 2024-04-13]
AAF9 AE84 3A75 84B5 A3E4 CD2B CF45 A512 DE2D A058
uid [ unknown] matrix.org packages <[email protected]>
sub rsa3072 2019-04-15 [S] [expires: 2021-04-14]
pub rsa4096 2017-05-22 [SC] [expires: 2025-05-20]
E1CF 20DD FFE4 B89E 8026 58F1 E0B1 1894 F66A EC98
uid [ unknown] Debian Archive Automatic Signing Key (9/stretch) <[email protected]>
sub rsa4096 2017-05-22 [S] [expires: 2025-05-20]
pub rsa4096 2014-11-21 [SC] [expires: 2022-11-19]
D211 6914 1CEC D440 F2EB 8DDA 9D6D 8F6B C857 C906
uid [ unknown] Debian Security Archive Automatic Signing Key (8/jessie) <[email protected]>
/etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
----------------------------------------------------------
pub rsa4096 2019-04-14 [SC] [expires: 2027-04-12]
80D1 5823 B7FD 1561 F9F7 BCDD DC30 D7C2 3CBB ABEE
uid [ unknown] Debian Archive Automatic Signing Key (10/buster) <[email protected]>
sub rsa4096 2019-04-14 [S] [expires: 2027-04-12]
/etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
-------------------------------------------------------------------
pub rsa4096 2019-04-14 [SC] [expires: 2027-04-12]
5E61 B217 265D A980 7A23 C5FF 4DFA B270 CAA9 6DFA
uid [ unknown] Debian Security Archive Automatic Signing Key (10/buster) <[email protected]>
sub rsa4096 2019-04-14 [S] [expires: 2027-04-12]
/etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
-------------------------------------------------------
pub rsa4096 2019-02-05 [SC] [expires: 2027-02-03]
6D33 866E DD8F FA41 C014 3AED DCC9 EFBF 77E1 1517
uid [ unknown] Debian Stable Release Key (10/buster) <[email protected]>
debian-buster를 사용할 때 왜 Jessie 및 Stretch 키가 있는지 궁금합니다. 위의 두 가지 키는 다음과 같습니다.
pub rsa4096 2017-05-22 [SC] [expires: 2025-05-20]
E1CF 20DD FFE4 B89E 8026 58F1 E0B1 1894 F66A EC98
uid [ unknown] Debian Archive Automatic Signing Key (9/stretch) <[email protected]>
sub rsa4096 2017-05-22 [S] [expires: 2025-05-20]
pub rsa4096 2014-11-21 [SC] [expires: 2022-11-19]
D211 6914 1CEC D440 F2EB 8DDA 9D6D 8F6B C857 C906
uid [ unknown] Debian Security Archive Automatic Signing Key (8/jessie) <[email protected]>
다음을 사용하여 키를 삭제했습니다.
$ sudo apt-key del E1CF20DDFFE4B89E802658F1E0B11894F66AEC98
또한 -
$ sudo apt-key del D21169141CECD440F2EB8DDA9D6D8F6BC857C906
두 키를 모두 삭제하면 공개 키 오류가 발생합니다.
$ sudo apt update
Hit:1 http://cdn-fastly.deb.debian.org/debian buster InRelease
Err:1 http://cdn-fastly.deb.debian.org/debian buster InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
Hit:2 http://cdn-fastly.deb.debian.org/debian-security buster/updates InRelease
Err:2 http://cdn-fastly.deb.debian.org/debian-security buster/updates InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D6D8F6BC857C906 NO_PUBKEY AA8E81B4331F7F50
Hit:3 http://cdn-fastly.deb.debian.org/debian unstable InRelease
Err:3 http://cdn-fastly.deb.debian.org/debian unstable InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
Hit:4 http://cdn-fastly.deb.debian.org/debian experimental InRelease
Err:4 http://cdn-fastly.deb.debian.org/debian experimental InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
Hit:5 http://debug.mirrors.debian.org/debian-debug buster-debug InRelease
Err:5 http://debug.mirrors.debian.org/debian-debug buster-debug InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
Hit:6 http://debug.mirrors.debian.org/debian-debug unstable-debug InRelease
Hit:7 http://debug.mirrors.debian.org/debian-debug experimental-debug InRelease
Err:6 http://debug.mirrors.debian.org/debian-debug unstable-debug InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
Err:7 http://debug.mirrors.debian.org/debian-debug experimental-debug InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
Hit:8 https://packages.riot.im/debian buster InRelease
Reading package lists... Done
Building dependency tree
Reading state information... Done
3 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://cdn-fastly.deb.debian.org/debian buster InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://cdn-fastly.deb.debian.org/debian-security buster/updates InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D6D8F6BC857C906 NO_PUBKEY AA8E81B4331F7F50
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://cdn-fastly.deb.debian.org/debian unstable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://cdn-fastly.deb.debian.org/debian experimental InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://debug.mirrors.debian.org/debian-debug buster-debug InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://debug.mirrors.debian.org/debian-debug unstable-debug InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://debug.mirrors.debian.org/debian-debug experimental-debug InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: Failed to fetch http://cdn-fastly.deb.debian.org/debian/dists/buster/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: Failed to fetch http://cdn-fastly.deb.debian.org/debian-security/dists/buster/updates/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 9D6D8F6BC857C906 NO_PUBKEY AA8E81B4331F7F50
W: Failed to fetch http://cdn-fastly.deb.debian.org/debian/dists/unstable/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: Failed to fetch http://cdn-fastly.deb.debian.org/debian/dists/experimental/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: Failed to fetch http://debug.mirrors.debian.org/debian-debug/dists/buster-debug/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: Failed to fetch http://debug.mirrors.debian.org/debian-debug/dists/unstable-debug/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC
W: Failed to fetch http://debug.mirrors.debian.org/debian-debug/dists/experimental-debug/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453E
내 /etc/apt/sources.list는 -
$ cat /etc/apt/sources.list
#### Debian buster #########
deb http://cdn-fastly.deb.debian.org/debian/ buster main contrib non-free
deb-src http://cdn-fastly.deb.debian.org/debian buster main contrib non-free
deb http://cdn-fastly.deb.debian.org/debian-security buster/updates main
deb-src http://cdn-fastly.deb.debian.org/debian-security buster/updates main
#### Debian unstable #########
deb http://cdn-fastly.deb.debian.org/debian unstable main contrib non-free
deb-src http://cdn-fastly.deb.debian.org/debian unstable main contrib non-free
#### Debian experimental #########
deb http://cdn-fastly.deb.debian.org/debian experimental main contrib
deb-src http://cdn-fastly.deb.debian.org/debian experimental main contrib
##### Debian Debug packages #######
deb http://debug.mirrors.debian.org/debian-debug/ buster-debug main
deb http://debug.mirrors.debian.org/debian-debug/ unstable-debug main
deb http://debug.mirrors.debian.org/debian-debug/ experimental-debug main
######## Third party repos #######
deb https://riot.im/packages/debian/ buster main
그리고 gpg를 사용하여 가져와야 합니다(안전하지 않다는 것을 알지만 그렇게 해야 했습니다 -)
# gpg --recv-keys AA8E81B4331F7F50
gpg: key EDA0D2388AE22BA9: 11 signatures not checked due to missing keys
gpg: key EDA0D2388AE22BA9: public key "Debian Security Archive Automatic Signing Key (9/stretch) <[email protected]>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg: imported: 1
그런 다음 -
# gpg --export AA8E81B4331F7F50 | apt-key add
OK
apt가 언제 최신 키뿐만 아니라 이전 버전의 서명도 지원하기 시작할지 알고 싶습니다. 이것은 최근의 현상인가요, 아니면 아주 오래된 현상인가요? 내 말은 Etch(4.0) 이상에서 완료되었다는 뜻인가요?
업데이트 - 원래는 Strech Install ie 9였으며 현재는 버스터가 있습니다.
다른 질문에 관한 한 /etc/apt/trusted.gpg.d/에는-
/etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
----------------------------------------------------------
pub rsa4096 2019-04-14 [SC] [expires: 2027-04-12]
80D1 5823 B7FD 1561 F9F7 BCDD DC30 D7C2 3CBB ABEE
uid [ unknown] Debian Archive Automatic Signing Key (10/buster) <[email protected]>
sub rsa4096 2019-04-14 [S] [expires: 2027-04-12]
/etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
-------------------------------------------------------------------
pub rsa4096 2019-04-14 [SC] [expires: 2027-04-12]
5E61 B217 265D A980 7A23 C5FF 4DFA B270 CAA9 6DFA
uid [ unknown] Debian Security Archive Automatic Signing Key (10/buster) <[email protected]>
sub rsa4096 2019-04-14 [S] [expires: 2027-04-12]
/etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
-------------------------------------------------------
pub rsa4096 2019-02-05 [SC] [expires: 2027-02-03]
6D33 866E DD8F FA41 C014 3AED DCC9 EFBF 77E1 1517
uid [ unknown] Debian Stable Release Key (10/buster) <[email protected]>
답변1
ftp-master가 각 버전별로 한 번씩 서명하는 방법에 대한 설명은 다음과 같습니다.ftp-master.debian.org:
어떤 버전에 어떤 키로 서명해야 합니까?
안정 릴리스는 릴리스 시 사용된 ftp-master 자동 아카이브 서명 키와 각 릴리스의 안정 키로 서명됩니다. 다른 버전(제안된 업데이트, 테스트, 제안된 업데이트 테스트, 불안정 및 실험적)의 릴리스 파일은 ftp-master 자동 키로만 서명됩니다.
보안 아카이브는 FTP 마스터 키로만 서명됩니다.
현재 절차는 버전당 하나의 FTP 마스터 키를 갖는 것입니다(이전 절차에서는 1년에 한 번씩 새 키를 도입했습니다).
archive.org에 따르면 (2009), 이것이 사실이었습니다.포함하다에칭풀어 주다:
현재 절차는 버전당 하나의 FTP 마스터 키를 갖는 것입니다(이전 절차에서는 1년에 한 번씩 새 키를 도입했습니다).
아카이브 키
활성 서명 키
현재(2007/etch) 키는 다음과 같습니다.여기서 다운로드하세요
패키지 제작과 관련이 있는 것 같습니다.debian-archive-keyring~을 위한에칭, 여기에는 다음을 포함하여 삭제한 파일이 포함됩니다.apt 이후에 따라 달라집니다에칭:
apt (0.6.46.2) unstable; urgency=low
* debian/control:
- depend on debian-archive-keyring to offer clean upgrade path
(closes:#386800)
[...]