If you look at the repository of a stable distributive branch debian gnu/linux:$ rsync rsync://mirror.yandex.ru/debian/dists/stable/
drwxr-xr-x 4,096 2019/04/27 12:31:23 .
-rw-r--r-- 1,984,315 2019/04/27 12:03:52 ChangeLog
lrwxrwxrwx 30 2017/06/17 11:44:51 Release
lrwxrwxrwx 34 2017/06/17 11:44:51 Release.gpg
drwxr-xr-x 4,096 2019/04/27 12:30:44 contrib
drwxr-xr-x 4,096 2019/04/27 12:30:44 main
drwxr-xr-x 4,096 2019/04/27 12:30:44 non-free
We'll see the file. Release and the signature to him... Release.gpg♪The contents of the signatures are three signatures i.e., the file. Release signed immediately with three keys, 8B48AD6246925553♪ 7638D0442B90D010 and EF0F382A1A7B6500 (this is mysterious identifiers):$ wget -qO - http://mirror.yandex.ru/debian/dists/stable/Release.gpg | gpg --list-packets
# off=0 ctb=89 tag=2 hlen=3 plen=563
:signature packet: algo 1, keyid 8B48AD6246925553
version 4, created 1556357444, md5len 0, sigclass 0x00
digest algo 8, begin of digest f0 eb
hashed subpkt 33 len 21 (issuer fpr v4 A1BD8E9D78F7FE5C3E65D8AF8B48AD6246925553)
hashed subpkt 2 len 4 (sig created 2019-04-27)
subpkt 16 len 8 (issuer key ID 8B48AD6246925553)
data: [4096 bits]
# off=566 ctb=89 tag=2 hlen=3 plen=563
:signature packet: algo 1, keyid 7638D0442B90D010
version 4, created 1556357444, md5len 0, sigclass 0x00
digest algo 8, begin of digest e6 a4
hashed subpkt 33 len 21 (issuer fpr v4 126C0D24BD8A2942CC7DF8AC7638D0442B90D010)
hashed subpkt 2 len 4 (sig created 2019-04-27)
subpkt 16 len 8 (issuer key ID 7638D0442B90D010)
data: [4096 bits]
# off=1132 ctb=89 tag=2 hlen=3 plen=563
:signature packet: algo 1, keyid EF0F382A1A7B6500
version 4, created 1556357613, md5len 0, sigclass 0x00
digest algo 8, begin of digest de 48
hashed subpkt 33 len 21 (issuer fpr v4 067E3C456BAE240ACEE88F6FEF0F382A1A7B6500)
hashed subpkt 2 len 4 (sig created 2019-04-27)
subpkt 16 len 8 (issuer key ID EF0F382A1A7B6500)
data: [4096 bits]
For example, here's the public part of the third of these keys (see the identifier EF0F382A1A7B6500?$ gpg --keyid-format long /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg 2>/dev/null | grep pub
pub rsa4096/EF0F382A1A7B6500 2017-05-20 [SC] [expires: 2025-05-18]
by having a public key in one of the files. /etc/apt/trusted.gpg.d/*.gpgwe can trust that signature.contents of the most signed fileRelease() These are the hesh soum and the size of the " service " repository files, most of which are the list of packages. e.g.:$ wget -qO - http://mirror.yandex.ru/debian/dists/stable/Release | sed -n 60p
8cebafcf8941b37fe32917320b8c2ef4 61114 contrib/binary-amd64/Packages.gz
Example of a package description in such a file:$ wget -qO - http://mirror.yandex.ru/debian/dists/stable/contrib/binary-amd64/Packages.gz |gunzip | head -n 20
Package: alien-arena
Version: 7.66+dfsg-3
Installed-Size: 2067
Maintainer: Debian Games Team <pkg-games-devel@lists.alioth.debian.org>
Architecture: amd64
Depends: libc6 (>= 2.17), libcurl3-gnutls (>= 7.16.2), libfreetype6 (>= 2.3.5), libgcc1 (>= 1:3.0), libjpeg62-turbo (>= 1.3.1), libogg0 (>= 1.0rc3), libstdc++6 (>= 4.1.1), libvorbis0a (>= 1.1.2), libvorbisfile3 (>= 1.1.2), libx11-6, libxxf86vm1, zlib1g (>= 1:1.1.4), libopenal1, alien-arena-data
Description: Standalone 3D first person online deathmatch shooter
Homepage: http://red.planetarena.org
Description-md5: de2b3d0db5845c79b22ffc0c38842f1b
Tag: game::fps, hardware::input:keyboard, hardware::input:mouse,
hardware::opengl, implemented-in::c, interface::3d,
interface::graphical, interface::x11, network::client, role::program,
uitoolkit::sdl, use::gameplaying, x11::application
Section: contrib/games
Priority: extra
Filename: pool/contrib/a/alien-arena/alien-arena_7.66+dfsg-3_amd64.deb
Size: 774388
MD5sum: d54108f51edd8ad9d147da8261e0473f
SHA256: 4c58933e396ba5977dade1318a3f0545a5a98283b87a8bbe5eecd2a5ccc5ec8a
The package, as you can see, also has information about the size of the file, and about its hesh soum.So the file Release.gpg certifies:authentic authentication of the " service files " listRelease)The fact that there are files on the list of sizes and hex-sums with the list of packages confirms the authenticity of the list of packages (e.g., contrib/binary-amd64/Packages.gz)a Because of the availability of hesh-sum bags on these lists and the size of baggage files, it also certifies the bag files themselves (e.g., pool/contrib/a/alien-arena/alien-arena_7.66+dfsg-3_amd64.deb)You're downloading the file with the bag, checking its size and computing the xash soum from the contents, and if it's done, the package is real.Oh, yeah, and he didn't answer the title.Where are the Linux repository index files stored?Yes, in the repository, and stored, I hope it's been quite clear and understandable, if it's not clear, I'll ask you to add the answer (them I know).to avoid downloading all the files listed above every time the programme is called apt, they're clashing. /var/lib/apt/lists/♪