What is a package repository, and why do package managers check GPG signatures?
A repository is a server holding packages and an index that package managers read. Packages and indexes are signed with GPG keys so your system can verify they came from the publisher and were not altered. Adding a third-party repository means trusting its key.
Explain it simply
A repository is like an app store for your distribution. The package manager reads a list of stores, downloads the catalogue from each and installs from them.
On Debian and Ubuntu, repositories are listed in /etc/apt/sources.list and /etc/apt/sources.list.d/. On Fedora and RHEL, they are .repo files in /etc/yum.repos.d/, managed with dnf repolist.
Why signatures? Anyone can run a mirror server, and downloads can be tampered with in transit. The publisher signs the repository metadata (and RPMs) with a private key. Your system holds the matching public key and rejects anything that does not verify.
When you add a third-party repository such as Docker's or PostgreSQL's, you also add its key. Modern Debian practice stores it in /etc/apt/keyrings/ and references it with signed-by= in the source line, rather than trusting the key for every repository. The old apt-key add method is deprecated.
Never disable checks (--allow-unauthenticated or gpgcheck=0) just to make an error go away.
Example
dnf repolist
# repo id repo name
# baseos Rocky Linux 9 - BaseOS
cat /etc/apt/sources.list.d/docker.list
# deb [signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu jammy stableWhat to say in the interview
"A repository holds packages plus signed metadata. The package manager verifies GPG signatures to ensure authenticity and integrity. For third-party repos I add only the vendor's key, scoped with signed-by, and never turn off signature checks."
Common mistakes
- Adding a random repository key system-wide or disabling gpgcheck to bypass an error.