NAME¶
debsig-verify - Verify signatures for a Debian format package
SYNOPSIS¶
- debsig-verify [options]
<deb>
DESCRIPTION¶
This program is part of a security model that verifies the source and validity
of a Debian format package (commonly refered to as a
deb).
This program implements the verification specs defined in the document, "
Package Verification with dpkg: Implementation", which is a more
complete reference for the verification procedure.
The program generally takes one argument, the
deb file to be verified. It
will then check the
origin signature of the
deb, find its Public
Key ID (long format), and use that as the name for a policy subdirectory. If
this subdirectory does not exist, then the verification fails immediately.
In this subdirectory, the program finds one or more files named with the
.pol file extension, which signifies an XML format policy definition.
This file contains three main parts.
- Origin
- Information about the origin of this policy.
- Selection
- Rules used to decide if this policy is pertinent to this
deb's verification.
- Verification
- Rules that are used to actually verify the deb.
The policy files will reference keyrings by a filename. These keyrings will be
looked for in a subdirectory of the keyring directory. The subdirectory has
the same name as the policy subdirectory (previously determined by the
Origin's Public Key ID).
The program will, after first parsing the entire file, check the Origin ID
against the Public Key ID of the
origin signature in the
deb. If
these match (which they should, else something is really wrong), then it will
proceed to the
Selection rules.
The
Selection rules decide whether this policy is suitable for verifying
this
deb. If these rules fail, then the program will proceed to the
next policy. If it passes, then the program commits to using this policy for
verification, and no other policies will be referenced.
The last verification step relies on the
Verification rules. These are
similar in format to the
Selection rules, but are usually more
constrained. If these rules fail, the program exits with a non-zero status. If
they pass, then it exits with a zero status.
OPTIONS¶
- -q
- Causes the program to send no output, other than fatal
errors. This is useful when being called from another program, where you
rely on the exit value only.
- -v
- Causes the program to send more output on execution, so as
to follow the steps it is taking while trying to verify the
deb.
- -d
- Outputs even more info than the -v option. This is
mainly for debugging.
- --version
- Outputs the version information for the program. This
includes the policy format version. This option does not require any other
arguments.
- --list-policies
- Outputs a list of the policies that passed the
Selection phase of the verification process. In other words, those
that could potentially verify the deb. The output is one line
showing the directory selected by the origin signature, and then a
single line for any policy files in that directory that pass the
Selection rules. This option will NOT verify the
deb.
- --use-policy <pol>
- This option takes one argument, which is the name of the
policy file (as shown by the --list-policies option). Note, this is
just a file, and not a full path. You cannot specifiy arbitrary policies.
This option is useful if more than one policy applies to potentially
verifying the deb. The program will then use this policy, and only
this policy, to try and verify the deb.
FILES¶
- /etc/debsig/policies/
- Directory containing the policy (.pol) definitions.
- /etc/debsig/policies/*/*.pol
- XML format policy files.
- /usr/share/debsig/keyrings/
- Directory containing the keyrings that coincide with the
policies.
- /usr/share/debsig/keyrings/*/*.gpg
- GPG format keyrings for use by the policies.
SEE ALSO¶
deb(5),
AUTHOR¶
Ben Collins <bcollins@debian.org>