Microsoft repo installed on all Raspberry Pi’s


In a recent update, the Raspberry Pi Foundation installed a Microsoft apt repository on all machines running Raspberry Pi OS (previously known as Raspbian) without the administrator’s knowledge.

Officially it’s because they endorse Microsoft’s IDE (!), but you’ll get it even if you installed from a light image and use your Pi headless without a GUI. This means that every time you do “apt update” on your Pi you are pinging a Microsoft server.

They also install Microsoft’s GPG key used to sign packages from that repository. This can potentially lead to a scenario where an update pulls a dependency from Microsoft’s repo and that package would be automatically trusted by the system.

I switched all my Pi’s to vanilla Debian but there are other alternatives too. Check the /etc/apt/sources.list.d and /etc/apt/trusted.gpg.d folders of your Pi’s and decide for yourself.

EDIT: Some additional information. The vscode.list and microsoft.gpg files are created by a postinstall script for a package called raspberrypi-sys-mods, version 20210125, hosted on the Foundation's repository.

Doing an "apt show raspberrypi-sys-mods" lists a GitHub repo as the package's homepage, but the changes weren't published until a few hours ago, almost two weeks after the package was built and hours after people were talking about this issue. Here a comment by a dev admitting the changes weren't pushed to GitHub until today:

People didn't have a chance to know about the new repo until it was already added to their sources, along with a Microsoft GPG key. Not very transparent to say the least. And in my opinion not how things should be done in the open source world.

you are viewing a single comment's thread.

view the rest of the comments →

all 1015 comments


14 points

3 months ago


14 points

3 months ago

I'm going to wait until risc-v sbc began to ship and buy those instead.


1 points

2 months ago