Spotify

BJ292 · 03-12-2015, 03:42 PM

Following the instructions on the spotify site to install on ubuntu/debian it says:

# 2. If you want to verify the downloaded packages,
# you will need to add our public key
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 94558F59

It's a reputable site so I did it and everything works ok.

Would this be a risky action at a less reputable site or is it more risky not to add the public key?

btmiller · 03-12-2015, 08:44 PM

The key allows you to verify that a package was signed off on by the owner of the key. If you do not trust the key owner, you should not be installing packages from them. Remember a package installation script runs as root, so it can do literally anything to your machine. So, I'd say that yes, there would be a massive risk in importing a key from someone you did not trust.