امنیت برای مدیرسیستم‌های شرکت فالکات اهمیت بسیاری دارد. به همین دلیل، آن‌ها باید اطمینان حاصل کنند که بسته‌های دریافتی از سرورهای دبیان در میان راه تغییر نمی‌کنند. یک خرابکار رایانه‌ای می‌تواند با قرار دادن کد مخرب در این بسته‌ها اعتبارشان را از بین ببرد. چنین بسته‌ای، در صورت نصب، آنطور که خرابکار طراحی‌اش کرده باشد کار می‌کند، برای نمونه درج گذرواژه‌ها یا اطلاعات حساس کاربر. برای دوری از این خطرات، دبیان از یک مهر و موم خاص -- در زمان نصب -- استفاده می‌کند که اطمینان می‌دهد بسته از منبع رسمی آن آمده و در میانه راه تغییر نکرده است.
The seal works with a chain of cryptographic hashes and a signature and is explained in detail in apt-secure(8). Starting with Debian 10 Buster the signed file is the InRelease file, provided by the Debian mirrors. There is also a legacy file called Release. Both contain a list of the Packages files (including their compressed forms, Packages.gz and Packages.xz, and the incremental versions), along with their SHA256 hashes, which ensures that the files haven't been tampered with. These Packages files contain a list of the Debian packages available on the mirror, along with their hashes, which ensures in turn that the contents of the packages themselves haven't been altered either. The difference between InRelease and Release is that the former is cryptographically signed in-line, whereas the latter provides a detached signature in the form of the file Release.gpg.
APT needs a set of trusted GnuPG public keys to verify signatures in the InRelease and Release.gpg files available on the mirrors. It gets them from files in /etc/apt/trusted.gpg.d/ and from the /etc/apt/trusted.gpg keyring (managed by the apt-key command). The official Debian keys are provided and kept up-to-date by the debian-archive-keyring package which puts them in /etc/apt/trusted.gpg.d/:
# ls /etc/apt/trusted.gpg.d/
debian-archive-bookworm-automatic.asc
debian-archive-bookworm-security-automatic.asc
debian-archive-bookworm-stable.asc
debian-archive-bullseye-automatic.asc
debian-archive-bullseye-security-automatic.asc
debian-archive-bullseye-stable.asc
debian-archive-buster-automatic.asc
debian-archive-buster-security-automatic.asc
debian-archive-buster-stable.asc
Once the appropriate keys are in the keyring, APT will check the signatures before any risky operation, so that frontends will display a warning if asked to install a package whose authenticity can't be ascertained.
Note, that binary packages are usually not signed. The integrity of a package can only be confirmed by checking its hashsums against a trusted (and possibly signed) hashsum source.
