dependency in this dependency resolution process architecture independent

Dependency in this dependency resolution process

This preview shows page 2 - 4 out of 4 pages.

dependency (in this dependency resolution process, architecture-independent packages are assumed to be of the same architecture as the host). A dependency can also be weakened to allow any architecture to fulfill it, with the package:any syntax, but foreign packages can only satisfy such a dependency if they are marked Multi-Arch: allowed. 8.3.6. Validating Package Authenticity System upgrades are very sensitive operations and you really want to ensure that you only install official packages from the Kali repositories. If the Kali mirror you are using has been compromised, a computer cracker could try to add malicious code to an otherwise legitimate package. Such a package, if installed, could do anything the cracker designed it to do including disclose passwords or confidential information. To circumvent this risk, Kali provides a tamper-proof seal to guarantee—at install time—that a package really comes from its official maintainer and hasn’t been modified by a third party. The seal works with a chain of cryptographic hashes and a signature. The signed file is the Release file, provided by the Kali mirrors. It contains a list of the Packages files (including their compressed forms, Packages.gz and Packages.xz, and the incremental versions), along with their MD5, SHA1, and SHA256 hashes, which ensures that the files haven’t been tampered with. These 202 Kali Linux Revealed Packages files contain a list of the Debian packages available on the mirror along with their hashes, which ensures in turn that the contents of the packages themselves haven’t been altered either. The trusted keys are managed with the apt-key command found in the apt package. This program maintains a keyring of GnuPG public keys, which are used to verify signatures in the Release.gpg files available on the mirrors. It can be used to add new keys manually (when non-official mirrors are needed). Generally however, only the official Kali keys are needed. These keys are automatically kept up-to-date by the kali-archive-keyring package (which puts the corresponding keyrings in /etc/apt/trusted.gpg.d). However, the first installation of this particular package requires caution: even if the package is signed like any other, the signature cannot be verified externally. Cautious administrators should therefore check the fingerprints of imported keys before trusting them to install new packages: # apt-key fingerprint /etc/apt/trusted.gpg.d/debian-archive-jessie- automatic.gpg ---------------------------------------------------------- pub 4096R/2B90D010 2014-11-21 [expires: 2022-11-19] Key fingerprint = 126C 0D24 BD8A 2942 CC7D F8AC 7638 D044 2B90 D010 uid Debian Archive Automatic Signing Key (8/jessie) /etc/apt/trusted.gpg.d/debian-archive-jessie-security-
Image of page 2
automatic.gpg ------------------------------------------------------------------- pub 4096R/C857C906 2014-11-21 [expires: 2022-11-19] Key fingerprint = D211 6914 1CEC D440 F2EB 8DDA 9D6D 8F6B C857 C906 uid Debian Security Archive Automatic Signing Key (8/jessie) /etc/apt/trusted.gpg.d/debian-archive-jessie- stable.gpg ------------------------------------------------------- pub 4096R/518E17E1 2013-08-17 [expires: 2021- 08-15] Key fingerprint = 75DD C3C4 A499 F1A1 8CB5 F3C8 CBF8 D6FD 518E 17E1 uid Jessie Stable Release Key /etc/apt/trusted.gpg.d/debian-archive-squeeze-automatic.gpg
Image of page 3
Image of page 4

You've reached the end of your free preview.

Want to read all 4 pages?

  • Summer '16
  • nushawan
  • Debian, Advanced Packaging Tool

  • Left Quote Icon

    Student Picture

  • Left Quote Icon

    Student Picture

  • Left Quote Icon

    Student Picture

Stuck? We have tutors online 24/7 who can help you get unstuck.
A+ icon
Ask Expert Tutors You can ask You can ask You can ask (will expire )
Answers in as fast as 15 minutes