I'm learning the basics of a Linux system and have been installing packages with commands like `dnf install tar`. How can I tell whether the packages are authentic and trustworthy rather than coming from someone impersonating the real project? Are there official repositories with signing, certifications, or other quality checks that I should look for?
2 Answers
The repositories configured by default are maintained by your Linux distribution or its trusted upstream maintainers. Those packages go through the distribution’s normal review and build process, so they’re generally the safest option. Be more cautious with repositories you add yourself, since you’ll need to evaluate whether their maintainers are trustworthy.
If you haven’t added any third-party repositories, `dnf` is normally downloading from your distribution’s official repositories. Packages are cryptographically signed, and the package manager checks those signatures automatically before installation to confirm the package came from an authorized source and hasn’t been altered.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures