signedby

Signed-by is an option in the APT package manager that binds a repository to a specific GPG public key file used to verify package signatures. By attaching a repository to a dedicated keyring, APT verifies that downloaded packages come from the intended source and have not been tampered with, rather than relying on a global set of trusted keys.

The primary purpose of the signed-by directive is to improve security and key management. It limits the scope of a repository’s signing keys to that repository only, reducing the risk if a key is compromised or if a repository changes its signing key. It also helps administrators manage trust separately for different sources and simplifies key rotation.

Syntax and usage are straightforward. The signed-by option appears inside the source entry’s option block, which is placed after the package type (deb or deb-src). For example:

deb [signed-by=/usr/share/keyrings/debian-archive-keyring.gpg] http://deb.debian.org/debian bullseye main

deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] http://archive.ubuntu.com/ubuntu focal main restricted

These lines tell APT to verify the packages for that repository against the keys in the specified keyring file.

Key management typically involves storing public keys in a keyring file (often under /usr/share/keyrings or /etc/apt/trusted.gpg.d) and ensuring the file is readable by APT. Keys can be added or updated with standard GPG tooling and by migrating from the deprecated apt-key mechanism to per-repository signed-by references.

Limitations include the need for a compatible APT version and correctly maintained keyrings. If the keyring is missing or does not contain the repository’s signing key, apt update will fail to verify signatures.