3 ms·
`apt update` runs over HTTP (no SSL)... Is this a common practice? This is a nice package otherwise.
by thekaleb 10y ago
`apt update` runs over HTTP (no SSL)... Is this a common practice?
This is a nice package otherwise.
- tssva 10y agoUsing HTTP for 'apt update' is common practice. Neither Debian or Ubuntu use https for their repositories. Instead the metadata for each repository is signed with a gpg key. The associated public key is distributed with the installation media and used to verify the metadata. The metadata includes checksums for the other files in the repository. Debian and Ubuntu include MD5, SHA-1 and SHA-256 checksums. Termux includes just the SHA-256 checksums. These checksums are used to verify the integrity of the other files in the repository.