apt signed-by test repository isolation with apt_preferences pinning

Answer

APT verifies the Release file signature using the key specified in signed‑by before it evaluates any pin priorities from apt_preferences.

Isolated test‑mirror setup

1. Create a test keyring file:

sudo gpg --no-default-keyring --keyring /etc/apt/trusted.gpg.d/test.gpg --import test‑mirror.asc

2. Add the repository to /etc/apt/sources.list.d/test.list with the signed‑by option:

deb [signed-by=/etc/apt/trusted.gpg.d/test.gpg] http://local-mirror/debian test‑suite main

3. Pin the test suite higher than the default in /etc/apt/preferences.d/test.pref:

Package: *
Pin: release a=test‑suite
Pin-Priority: 900

4. Leave the global keyring untouched; the test key is only in /etc/apt/trusted.gpg.d/test.gpg.

Using AllowInsecureRepositories

Setting AllowInsecureRepositories=true in a file under /etc/apt/apt.conf.d/ (e.g., 99test-insecure) disables signature checks for that repository:

APT::Get::AllowInsecureRepositories "true";

This bypasses the signed‑by verification entirely, so it is only acceptable when you deliberately accept an unsigned Release file and understand the risk of tampered packages. For a signed test mirror, keep AllowInsecureRepositories false and rely on the isolated keyring.

Verification steps

• Confirm the test key is isolated: gpg --list-keys --keyring /etc/apt/trusted.gpg.d/test.gpg
• Run apt update and check /var/log/apt/term.log for Release file signature verification succeeded.
• Validate pinning with apt-cache policy <package> to see the test version selected.