<refmeta>
<refentrytitle>apt-secure</refentrytitle>
<manvolnum>8</manvolnum>
+ <refmiscinfo class="manual">APT</refmiscinfo>
</refmeta>
<!-- NOTE: This manpage has been written based on the
different steps. <command>apt-secure</command> is the last step in
this chain, trusting an archive does not mean that the packages
that you trust it do not contain malicious code but means that you
- trust the archive maintainer. Its the archive maintainer
+ trust the archive maintainer. It's the archive maintainer
responsibility to ensure that the archive integrity is correct.
</para>
is computed and put in the Packages file. The MD5 sum of all of the
packages files are then computed and put into the Release file. The
Release file is then signed by the archive key (which is created
- once a year and distributed through the FTP server. This key is
+ once a year) and distributed through the FTP server. This key is
also on the Debian keyring.
</para>
<listitem><para><literal>Mirror network compromise</literal>.
Without signature checking, a malicious agent can compromise a
- mirror host and modify the files in it to propage malicious
+ mirror host and modify the files in it to propagate malicious
software to all users downloading packages from that
host.</para></listitem>
</itemizedlist>
</para>
<itemizedlist>
- <listitem><para><literal>Create a toplevel Release
- file</literal>. if it does not exist already. You can do this
+ <listitem><para><emphasis>Create a toplevel Release
+ file</emphasis>, if it does not exist already. You can do this
by running <command>apt-ftparchive release</command>
- (provided inftp apt-utils).</para></listitem>
+ (provided in apt-utils).</para></listitem>
- <listitem><para><literal>Sign it</literal>. You can do this by running
+ <listitem><para><emphasis>Sign it</emphasis>. You can do this by running
<command>gpg -abs -o Release.gpg Release</command>.</para></listitem>
- <listitem><para><literal>Publish the key fingerprint</literal>,
+ <listitem><para><emphasis>Publish the key fingerprint</emphasis>,
that way your users will know what key they need to import in
order to authenticate the files in the
archive.</para></listitem>
<refsect1><title>See Also</title>
<para>
-&apt-conf;, &apt-get;, &sources-list;, &apt-key;, &apt-archive;,
+&apt-conf;, &apt-get;, &sources-list;, &apt-key;, &apt-ftparchive;,
&debsign; &debsig-verify;, &gpg;
</para>
-<para>For more backgound information you might want to review the
+<para>For more background information you might want to review the
<ulink
url="http://www.debian.org/doc/manuals/securing-debian-howto/ch7.en.html">Debian
Security Infrastructure</ulink> chapter of the Securing Debian Manual