Score:0

Can I co-sign a repo for maximum security? In other ways: only update with their signature + mine (auditing protonv pn)

us flag

According to https://protonvpn.com/support/official-linux-vpn-debian/, to install ProtonVPN on ubuntu, I should just download the .deb, which installs the protonvpn repo:

deb [signed-by=/usr/share/keyrings/protonvpn-stable-archive-keyring.gpg] https://repo.protonvpn.com/debian stable main

then sudo apt update && sudo apt-get install protonvpn

The ProtonVPN app is a python one, and it's distributed as source code, so I can audit it directly from source code.

Is there a way to require a second signature, from me, to download the newest proton vpn? This way I could audit the app before updating to a new version.

The ideal for me would not be to have my own repo, which would be dangerous, but to require both their AND my signature. I'd inspect the code from another computer and sign.

muru avatar
us flag
What exactly do you think you'll be signing?
us flag
@muru whatever is distributed through apt. In this case, the source of the app
muru avatar
us flag
But you don't have access to the original to sign it, and you don't want to make a copy on which your signature can be added.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.