Install-instructions for Linux: Add a way to verify fingerprint of keys.asc

[johays]

Dear developers,

It would be very nice, if you add some kind of verification-method for the fingerprint of the keys.asc file found at https://updates.signal.org/desktop/apt/keys.asc

The current install-method for Linux works superb and out-of-the-box, but I expect many security-conscious users would prefer at least to be able to verify the fingerprint before adding it to their apt-keychain. Right now I don't see any way of verifying the key for normal users.

(for inspiration, this is how Tor Browser advice their users to verify their key: https://support.torproject.org/tbb/how-to-verify-signature/ )

Best regards,
Johay

[scottnonnenberg-signal]

This is very similar to a general 'linux install improvement' issue currently open: #3714

[benjaoming]

to be able to verify the fingerprint before adding it to their apt-keychain

It's not a fingerprint that's added to apt-keychain, it's a public key. This makes apt able to verify the metadata of the repository, which specifies the checksums of the packages downloaded from updates.signal.org. This would guard you against the site being hacked and publishing unauthorized metadata about packages. If there is a mismatch between the repository metadata and the packages listed, apt won't download and install the package with dpkg. It's the same level of security/trust given to any other Debian repository on your system.

If you downloaded a .deb file seperately ("the Windows .exe way"), it would need to be verified, and that's the same approach that the Tor Browser article takes.

There is also a signature inside the .deb files, and I think you can force dpkg to add a verification of this, such that you guard yourself from being tempted to install unsigned or untrusted .deb files with dpkg -i.

To know more, check out this article which explains both apt and dpkg (repository and package) approaches to verification.

dpkg has support for verifying GPG signatures of Debian package files, but this verification is disabled by default. This means that when a package is installed on a Debian-based system, the signature checking for individual packages is disabled.

In order to enable it, the file /etc/dpkg/dpkg.cfg will need to be modified to remove the no-debsig option from the config file.

The installation instructions have to be improved as with #3714 -- but I am not sure if Signal will benefit from venturing down a road of encouraging to download .deb files and voluntarily check their signatures.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.