Verify the integrity of .deb files

[goennrad]

Hey there,

i want to install the latest version of virtual box for Debian 12, but verification of the SHA256 checksums is not available.
The Debian 12 .deb file and the checksums containing all checksums of the regarding virtualbox version can be found going to Downloads > Linux Distributions on the official website.

These checksums are NOT signed and there are NO instructions if there is a signed version or even where the signing key is.
I cant install Virtualbox from the apt repository because its not possible for Debian 12 what i'm using.
I wont install software without verifying the checksum of the .deb file!

I'm a right about this are do i just don't see the required files. I cant imagine that there are not any signing keys for the .deb files.

Big thank in advance for any help!!

[fth0]

AFAIK, the Oracle VirtualBox repository only uses the APT repository metadata signing:

If you followed the instructions on Download VirtualBox for Linux Hosts, your APT client should verify the repository's signed "Releases" file, the checksum of the "Packages" file and the checksum of the package.

In consequence, you shouldn't need signed deb files. Why do you think otherwise?

[goennrad]

Im using debian 12
The repository is only until debian 11 bullseye
thats the problem

[goennrad]

Update
The website says only until bullseye, but actually if you replace <mydist> with bookworm it works
so problem solved i guess

[scottgus1]

Excellent, that's good news! FWIW the wiki pages can fall behind sometimes.