Package-Master

Prove what you publish

Verify a snapshot yourself

Every repository Package-Master publishes is signed by default. A filtered set is signed with your instance key. An unfiltered mirror can instead pass the upstream Debian or Canonical signature through byte for byte, so apt keeps verifying against the keys it already trusts. An unsigned publish is refused unless an operator explicitly overrides it. You can check a published set yourself with standard tooling, and we tell you how.

Run Scout free What is supported

One boundary, stated up front

Signing covers what this instance publishes. Package-Master does not verify upstream signatures when it ingests from a source today. We say that here rather than let you assume a chain that does not exist.

  1. 1. Fetch the signing key the server publishes

    Every published repository serves its own public key at a stable address, including a fingerprint-pinned copy, so the key you fetched cannot be silently rotated out from under you.

  2. 2. Pin the key on your machines

    Point each source at the published endpoint using apt's standard key pinning. No blanket trust flags. If the publish preserves upstream signatures instead, keep verifying against the Debian or Canonical archive keyring you already have.

  3. 3. Let apt verify every update

    apt fetches the signed release metadata and refuses the repository if the signature does not match the pinned key. You can also verify the signature by hand with standard GnuPG tooling.

  4. 4. Confirm content checksums

    The signed release metadata carries checksums for every index it covers, and package blobs are served content-addressed by their SHA-256. You can compare the checksum of any downloaded package against what the signed index declares for it.

The step-by-step walkthrough, with the exact commands, key locations, and sources-line format, is in the install and verification guide.

Get the step-by-step guide

What you are checking

You are checking that the set your machines install from is exactly the set this instance published, signed with a key you pinned, and that nothing was altered in between. It is not a statement about whether your organization is compliant. And to be precise about the boundary: Package-Master does not verify upstream signatures when it ingests from a source today. Signing proves the published set is yours and intact. It does not extend the upstream vendor's signature through a filtered set.

Scout measures your sources. These checks cover the signature over the set you publish.

Run Scout free