Package signing keys

What it inspects

Looks for this finding: Package repositories have no signing keys configured. On Debian and Ubuntu, how many files are in /etc/apt/trusted.gpg.d/; one or more passes. If that is empty, it reads the apt sources (Signed-By: in /etc/apt/sources.list.d/*.sources and [signed-by=...] in sources.list and *.list) and passes only if a keyring file they name exists (the layout Ubuntu 24.04 and Debian 13 use); keyring packages that merely sit in /usr/share/keyrings do not count. A non-empty legacy /etc/apt/trusted.gpg also passes. Otherwise it counts the `gpg-pubkey` packages in the rpm database: one or more passes. With apt installed and no key found anywhere, or rpm installed and zero pubkeys, it fails (a Debian-family host using trusted=yes sources fails too). It is skipped only when neither apt nor rpm is installed, or no query gives a number. `apt-get update` completing with no NO_PUBKEY or signature errors is the real confirmation of Signed-By setups.

Why it matters

Finding: Package repositories have no signing keys configured. Package signatures are how your system knows an update really came from your distribution. Without the signing keys, either every installation fails or someone turns signature checking off, and then a tampered mirror or network attacker can hand you a malicious package. Restoring the keys keeps signature verification working.

How to verify

# Debian/Ubuntu:
ls /etc/apt/trusted.gpg.d/
# RHEL family:
rpm -qa gpg-pubkey

How to fix

Clears the finding "Package repositories have no signing keys configured". Debian/Ubuntu: reinstall the distribution keyring package. RHEL family: import the signing keys that installed packages ship in /etc/pki/rpm-gpg.

# Restores the distribution's archive signing keys from the keyring package that ships them.
# Other Debian derivatives are left alone: install the keyring package your distribution documents.
# Releases that keep archive keys as Signed-By keyrings in /usr/share/keyrings (Ubuntu 24.04+, Debian 13) may have
# nothing in /etc/apt/trusted.gpg.d; the scanner also counts those keyring files. The real confirmation is that
# `apt-get update` completes with no NO_PUBKEY or signature errors.
. /etc/os-release
case "$ID" in
ubuntu) pkg=ubuntu-keyring ;;
debian) pkg=debian-archive-keyring ;;
*) pkg="" ;;
esac
if [ -n "$pkg" ]; then
apt-get update
apt-get install -y --reinstall "$pkg"
else
echo "Unknown distribution ($ID): reinstall your distribution's keyring package by hand"
fi
ls /etc/apt/trusted.gpg.d/

# Imports the signing keys that installed packages (the distro's *-gpg-keys / release packages) put in
# /etc/pki/rpm-gpg. Files that no installed package owns are skipped, so a planted file is never trusted.
# Review the list afterwards: `rpm -qa gpg-pubkey` and, per key, `rpm -qi gpg-pubkey-<id>`.
# Some releases also ship keys this rpm cannot read yet (e.g. Rocky 9's V6 post-quantum key): those are reported and skipped.
for k in /etc/pki/rpm-gpg/RPM-GPG-KEY-*; do
if [ -f "$k" ] && rpm -qf "$k" >/dev/null 2>&1; then
rpm --import "$k" || echo "skipped $k: this rpm could not import it (newer key format?)"
fi
done
rpm -qa gpg-pubkey

References

• Debian wiki: SecureApt
• apt-get(8) manual page