archive keyring available in the ubuntu-keyring package.

       End users can check the signature of the Release file, extract a checksum of a package from
       it and compare it with the checksum of the package they downloaded by hand - or rely on APT
       doing this automatically.

       Notice that this is distinct from checking signatures on a per package basis. It is designed
       to prevent two possible attacks:

       •   Network "man in the middle" attacks. Without signature checking, malicious agents can
           introduce themselves into the package download process and provide malicious software
           either by controlling a network element (router, switch, etc.) or by redirecting traffic
           to a rogue server (through ARP or DNS spoofing attacks).

       •   Mirror network compromise. Without signature checking, a malicious agent can compromise
           a mirror host and modify the files in it to propagate malicious software to all users
           downloading packages from that host.

       However, it does not defend against a compromise of the master server itself (which signs
       the packages) or against a compromise of the key used to sign the Release files. In any
       case, this mechanism can complement a per-package signature.

INFORMATION CHANGES
       A Release file contains beside the checksums for the files in the repository also general
       information about the repository like the origin, codename or version number of the release.

       This information is shown in various places so a repository owner should always ensure
       correctness. Further more user configuration like apt_preferences(5) can depend and make use
       of this information. Since version 1.5 the user must therefore explicitly confirm changes to
       signal that the user is sufficiently prepared e.g. for the new major release of the
       distribution shipped in the repository (as e.g. indicated by the codename).

USER CONFIGURATION
       apt-key is the program that manages the list of keys used by APT to trust repositories. It
       can be used to add or remove keys as well as list the trusted keys. Limiting which key(s)
       are able to sign which archive is possible via the Signed-By in sources.list(5).

       Note that a default installation already contains all keys to securely acquire packages from
       the default repositories, so fiddling with apt-key is only needed if third-party
       repositories are added.

       In order to add a new key you need to first download it (you should make sure you are using
       a trusted communication channel when retrieving it), add it with apt-key and then run
       apt-get update so that apt can download and verify the InRelease or Release.gpg files from
       the archives you have configured.

REPOSITORY CONFIGURATION
       If you want to provide archive signatures in an archive under your maintenance you have to:

       •   Create a toplevel Release file, if it does not exist already. You can do this by running
           apt-ftparchive release (provided in apt-utils).

       •   Sign it. You can do this by running gpg --clearsign -o InRelease Release and gpg -abs -o
           Release.gpg Release.

       •   Publish the key fingerprint, so that your users will know what key they need to import
 Manual page apt-secure(8) line 62/165 77% (press h for help or q to quit)