4 ms·
How are packages authenticated? I did an evaluation a couple of months ago but decided to drop it when I saw that packages where being pulled over plain HTTP an
by goodplay 11y ago
How are packages authenticated? I did an evaluation a couple of months ago but decided to drop it when I saw that packages where being pulled over plain HTTP and seemingly no authentication was being preformed.
For software build systems - my use case - this type of security lapse is a deal breaker.
- aidenn0 11y agoI don't know about msys2, but pacman supports gpg signatures, so all they would need to do (and perhaps have done already) would be to configure it for master keys. The initial download that includes the master public keys ought to be done over https, of coures.
- rossy 11y agoYep. MSYS2 uses pacman's support for GPG signatures. The links to the installers on the website don't use HTTPS, but it looks like they've added checksums of the installers to the website itself, which is served over HTTPS.
- DavidEGrayson 11y agoFor what it's worth, pacman does support GPG signature verification, HTTPS, and SHA-256 checksums. There is a GitHub user right now making a bunch of pull requests to MSYS2 to make our PKGBUILD scripts more secure, mostly by using HTTPS and SHA-256 whenever possible.