ESP-IDF's Linux install adds its package repository with deb [trusted=yes] https://dl.espressif.com/dl/eim/apt/ stable main. What does [trusted=yes] do, and why is it a security trade-off?
It tells APT to accept that repository even though its packages are not signed with a key APT knows. Integrity then rests only on HTTPS to Espressif's server; APT's own signature check, which protects against a compromised mirror or server, is switched off for that source.
Normally APT verifies a signed Release file for every repository against keys installed on the system. That signature is what guarantees the packages are the ones the publisher built, even if a mirror, a CDN or the transport is compromised. A repository without a known key is refused.
[trusted=yes] overrides that refusal for this one source. The practical effect:
- What still protects you: the URL is
https://, so the download is encrypted and the server is authenticated by its TLS certificate. - What is lost: if anyone can change the files on Espressif's download server, or an attacker gets a certificate for it, APT installs their packages as root without complaint. With signing, they would also need Espressif's private signing key.
This is exactly the software supply-chain problem the module raises for IoT firmware: you verify a signature so that compromising a distribution server is not enough. The more careful setup is to import the vendor's signing key and use signed-by= instead of trusted=yes, when the vendor publishes one.
Go deeper:
Debian manpage — sources.list(5) — the trustedandsigned-byoptions and what each one checks.- Wikipedia — Supply chain attack — real cases where compromised update and distribution servers delivered malware.