I'm learning the basics of package management and have been installing things with commands like `dnf install tar`. How can I tell whether the packages are authentic and maintained by a trustworthy source rather than being impersonated or uploaded by someone else? Do package repositories use signing, certifications, or another quality-verification system?
3 Answers
Fedora and similar distributions don’t allow just anyone to upload packages to their official repositories. That’s why installing through the configured repositories is preferable to downloading an RPM from a random website. For third-party RPMs or repositories, you need to evaluate the source yourself and make sure the signing key and repository are legitimate.
The repositories configured by default are maintained by your Linux distribution or its trusted upstream providers. They have established review and release processes, so packages from those sources are generally the safest option. The main thing to watch out for is adding third-party repositories without checking who operates them and how they maintain their packages.
If you haven’t added any extra repositories, packages installed through `dnf` should come from your distribution’s official repositories. Repository packages are cryptographically signed, and the package manager verifies those signatures and checks the files’ integrity before installing them.
That makes sense. Why aren’t repositories such as RPM Fusion enabled by default if they’re commonly used?