我如何不信任易于键入Debian Linux，或者阻止通过静默添加apt-key（就像大多数商业软件包在其脚本中所做的那样postinst）？
如果我运行apt-key adv --edit-key ... trust，它似乎没有任何效果：
# apt-key adv --edit-key D38B4796 trust
Executing: /tmp/apt-key-gpghome.poumWAEgYJ/gpg.1.sh --edit-key D38B4796 trust
gpg (GnuPG) 2.1.18; Copyright (C) 2017 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
pub rsa4096/7721F63BD38B4796
created: 2016-04-12 expires: never usage: SC
sub rsa4096/1397BC53640DB551
created: 2016-04-12 expires: 2019-04-12 usage: S
sub rsa4096/6494C6D6997C215E
created: 2017-01-24 expires: 2020-01-24 usage: S
[ unknown] (1). Google Inc. (Linux Packages Signing Authority) <[email protected]>
pub rsa4096/7721F63BD38B4796
created: 2016-04-12 expires: never usage: SC
sub rsa4096/1397BC53640DB551
created: 2016-04-12 expires: 2019-04-12 usage: S
sub rsa4096/6494C6D6997C215E
created: 2017-01-24 expires: 2020-01-24 usage: S
[ unknown] (1). Google Inc. (Linux Packages Signing Authority) <[email protected]>
Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)
1 = I don't know or won't say
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately
m = back to the main menu
Your decision? 2
pub rsa4096/7721F63BD38B4796
created: 2016-04-12 expires: never usage: SC
sub rsa4096/1397BC53640DB551
created: 2016-04-12 expires: 2019-04-12 usage: S
sub rsa4096/6494C6D6997C215E
created: 2017-01-24 expires: 2020-01-24 usage: S
[ unknown] (1). Google Inc. (Linux Packages Signing Authority) <[email protected]>
Please note that the shown key validity is not necessarily correct
unless you restart the program.
gpg>
- 所以当我重新运行时apt-key list，信任级别仍然是unknown：
# apt-key list D38B4796
pub rsa4096 2016-04-12 [SC]
EB4C 1BFD 4F04 2F6D DDCC EC91 7721 F63B D38B 4796
uid [ unknown] Google Inc. (Linux Packages Signing Authority) <[email protected]>
sub rsa4096 2016-04-12 [S] [expires: 2019-04-12]
sub rsa4096 2017-01-24 [S] [expires: 2020-01-24]
答案1
据我所知，密钥上的信任设置对apt.在这种情况下，信任是指赋予签名的值其他键的用给定的密钥制作；它是关于信任网络中的传递信任，而不是对使用给定密钥创建的包签名（或更确切地说，存储库签名）的有效性的信任。
要“不信任”存储库密钥，您需要将其删除。
为了防止软件包安装新的密钥环，您可以将一个文件添加到/etc/dpkg/dpkg.cfg.d/，例如no-new-keyrings，包含
# Skip installation of new keyrings by default, but allow Debian keyrings
path-exclude=/etc/apt/trusted.gpg.d/*
path-include=/etc/apt/trusted.gpg.d/debian-archive-*
这不会阻止使用apt-key;安装密钥的软件包要做到这一点可能需要编写一个包装器。