Verify repository's key

Question

Hi,

According to wiki.ros.org/hydro/Installation/Debian to install ROS on Debian, the GnuPG-key used to sign the repository should be installed by using

wget packages.ros.org/ros.key -O - | sudo apt-key add -

However, the key stored in ros.key hasn't been signed by anyone and the server doesn't support HTTPS. So this key doesn't provide much security against person-in-the-middle-attacks. Would it be possible to have this key signed by admins or developers actively using GnuPG/PGP (i.e. they already participated a key-signing-party or otherweise exchanged they public key with some people), who can assure, that this is the genuine archive's key? Is there any SSL-enabled webserver available which could be used to provide the key?

Kind regards, B. Wildenhain

---

Originally posted by bwildenhain on ROS Answers with karma: 73 on 2014-06-20

Post score: 6

---

Original comments

Comment by demmeln on 2014-06-20:
@William @tfoote

Answer 1

The key is now available on keyserver.ubuntu.com

The wget line can be replaced with

sudo -E apt-key adv --keyserver 'hkp://keyserver.ubuntu.com:80' --recv-key C1CF6E31E6BADE8868B172B4F42ED6FBAB17C654

Please test that it works and then we can update the installation instructions.

Update:

It is also now available from the ros/rosdistro repo on GitHub over https at: https://raw.githubusercontent.com/ros/rosdistro/master/ros.key

Or of course you can get it via git over ssh.

---

Originally posted by tfoote with karma: 58457 on 2014-06-20

This answer was ACCEPTED on the original site

Post score: 2

---

Original comments

Comment by bwildenhain on 2014-06-20:
Thanks, looks good :-)

Comment by ajm on 2019-07-08:
There seems to be some kind of issue with the apt-key adv... command you provided on kinetic with Ubuntu 16.04, I had to manually download the key then do sudo apt-key add ros.key

Comment by gvdhoorn on 2019-07-08:
@ajm: I believe you're actually running into #q325039. The keys have changed since this answer was posted.

Edit: I've edited the answer by @tfoote and updated the command and the key.

Comment by bwildenhain on 2019-07-18:
Thanks for the update. I can confirm that it now works in a more secure way. However, I would suggest the following two lines to adapt the code for Debian users, which are not using oldoldstable (current version is buster). The signed-by approch is suggested by https://wiki.debian.org/DebianRepository/UseThirdParty

1. sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/ros.org-keyring.gpg] http://packages.ros.org/ros/ubuntu $(lsb_release -s -c) main" > /etc/apt/sources.list.d/ros-latest.list'
2. wget https://raw.githubusercontent.com/ros/rosdistro/master/ros.key -O - | gpg --dearmor | sudo dd of=/usr/share/keyrings/ros.org-keyring.gpg

Answer 2

I can get the key from the server, but it doesn't increase security: The HKP protocol used to communicate with keyserver is based on HTTP, not on HTTPS. Quote from https://tools.ietf.org/html/draft-shaw-openpgp-hkp-00#section-8: "all search results must be regarded as untrustworthy and informational only"

---

Originally posted by bwildenhain with karma: 73 on 2014-06-20

This answer was NOT ACCEPTED on the original site

Post score: 1