update: Add notice about missing Signed-By in deb822 sources

We want to gently steer users towards having Signed-By for each
source such that we can retire a shared keyring across sources
which improves resilience against configuration issues and
incompetent malicious actors.

1 files changed, 14 insertions, 0 deletions

diff --git a/apt-private/private-update.cc b/apt-private/private-update.cc
index d6f7d62dd..cc0753c26 100644
--- a/apt-private/private-update.cc
+++ b/apt-private/private-update.cc
@@ -233,6 +233,20 @@ bool DoUpdate()
       }
    }
 
+   if (_config->FindB("APT::Get::Update::SourceListWarnings::SignedBy", SLWarnings))
+   {
+      for (auto *S : *List)
+      {
+	 if (not S->HasFlag(metaIndex::Flag::DEB822) || not S->GetSignedBy().empty())
+	    continue;
+
+	 URI uri(S->GetURI());
+	 // TRANSLATOR: the first is manpage reference, the last the URI from a sources.list
+	 _error->Notice(_("Missing Signed-By in the %s entry for '%s'"),
+			"sources.list(5)", URI::ArchiveOnly(uri).c_str());
+      }
+   }
+
    // show basic stats (if the user whishes)
    if (_config->FindB("APT::Cmd::Show-Update-Stats", false) == true)
    {