How verification works
Understand the checks on package sources, bundle contents, and offline installation.
On this page
Debark checks software at two points: when packages are downloaded and when the finished bundle is opened on the target. These checks answer different questions.
Where did the packages come from?
For packages fetched through apt, the build checks the repository’s signed metadata and the downloaded package checksums.
The lock file records the source of each package and how it was checked:
| Value | Meaning |
|---|---|
apt-signed |
The package came through apt’s signed repository metadata. |
user-digest |
A checksum you supplied matched the downloaded file. |
user-signature |
A supplied publisher signature was verified. This value is supported by the format. |
url-unverified |
The download has no verified publisher signature or user-supplied checksum. |
HTTPS protects the connection to a download server. It does not, by itself, establish that a vendor package is the release you intended to use.
For direct downloads, obtain the expected checksum from a trusted vendor source and pass it with --digest. See Include vendor packages.
Did the bundle arrive unchanged?
The manifest lists bundle files and their SHA-256 checksums. The builder’s signature covers the manifest. Verification checks the signature, then checks the files against it.
The target needs a trusted copy of the builder’s public key. Deliver that key separately, such as during machine provisioning.
A valid bundle signature establishes who signed the bundle and whether its files match that signed record. It does not turn an unverified vendor download into a verified publisher release.
What happens during installation?
debark install verifies the bundle before making it available to apt. It then requests the versions recorded in the lock, using temporary settings for the bundled repository.
The generated repository’s Release file is not separately signed. Debark’s manifest and signature provide the integrity check for a normal Debark installation.
If you use --keep-source, apt retains a source marked Trusted: yes. Later apt commands can use that repository without Debark verification. Keep the directory protected from untrusted writes and use this option only when you intend to maintain a permanent local repository.
What these checks do not establish
A correctly signed package can still have bugs or unsafe behavior. Verification does not inspect application behavior, find all network-dependent installation scripts, or check for known vulnerabilities.
debark doctor can flag some common offline installation issues. An optional SBOM gives external inventory and vulnerability tools a package list to work with.
The builder, signing keys, target machine, apt, and dpkg remain part of the setup you trust. Debark’s checks cannot compensate for a compromised signing key or operating system.
Reporting a vulnerability
Report security issues privately through the repository’s Security → Report a vulnerability option. The security policy describes the reporting process and supported versions.
Use GitHub issues for ordinary bugs.