Overview
How do you know a downloaded package is genuine and unmodified? Verification — through cryptographic signatures and checksums — is what lets the package manager (and you) trust software before installing it. This lesson explains package verification.
Learning objectives
- Explain package signing and how signatures are verified.
- Distinguish integrity (checksums) from authenticity (signatures).
- Describe why verification matters for the software supply chain.
Core concept
Package managers verify software using cryptography:
- Checksums (hashes) — a fingerprint (e.g. SHA-256) of a file. Recomputing it and comparing confirms the file was not corrupted or altered (integrity).
- Digital signatures — repositories sign packages (and their indexes) with a private key; the package manager checks the signature against a trusted public key it holds, confirming the package genuinely came from the expected source (authenticity) and is unmodified.
Integrity answers "is this file intact?"; authenticity answers "did it really come from who I trust?"
How it works
Distributions ship trusted public keys; the package manager uses them to verify the signature on repository metadata and packages automatically during install. If a signature does not verify — because the package was tampered with, or comes from an unrecognized key — the manager warns or refuses to install. Checksums provide an additional integrity check, commonly used when downloading a file (like an ISO) manually: you compare the published hash to the one you compute locally.
Practical example
When you run apt install, the manager silently verifies the repository's signature before trusting its packages — if verification fails, you see an error rather than a silent install. For a manually downloaded file, you might verify integrity yourself:
$ sha256sum downloaded.iso
3f2a...c19 downloaded.iso
You then compare 3f2a...c19 against the checksum the vendor published; a match means the file is intact. (A checksum alone proves integrity, not authenticity — a signature is needed for that.)
Cybersecurity relevance
Verification is a core supply-chain security defense. Signature checking prevents installing tampered or spoofed packages — for instance, a malicious mirror serving altered software would fail signature verification. Disabling verification (e.g. forcing installs past signature errors) removes this protection and is dangerous. When obtaining software or files, confirming both integrity (checksum) and authenticity (signature) is best practice, and understanding the distinction is important: a matching checksum from an untrusted source proves nothing about who made the file.
Common mistakes
- Confusing checksums with signatures — checksums prove integrity, signatures prove authenticity (and integrity).
- Ignoring or bypassing signature warnings, defeating supply-chain protection.
- Trusting a checksum from the same untrusted source as the file — authenticity still needs a signature.
Key takeaways
- Verification uses checksums (integrity — file unaltered) and digital signatures (authenticity — genuinely from a trusted source, and unaltered).
- Package managers automatically verify repository/package signatures against trusted public keys and refuse or warn on failure.
- Verification is a key supply-chain defense against tampered/spoofed software; never bypass signature checks, and remember a checksum alone does not prove authenticity.
Check your understanding
- What is the difference between what a checksum proves and what a digital signature proves?
- Why is bypassing a package manager's signature verification a security risk?