3 ms·
Apt repositories are typically PGP signed. Even in the case where you just obliviously add the repository's PGP key, you are protected against the file server b
by zurn 10y ago
Apt repositories are typically PGP signed. Even in the case where you just obliviously add the repository's PGP key, you are protected against the file server being compromised. Also if you find malicious things in a signed package, that takes away some deniability from repository principal.
Then there's https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- kentonv 10y ago> Even in the case where you just obliviously add the repository's PGP key, you are protected against the file server being compromised. Unless you got the PGP key from the same file server, which is typical.
- zurn 10y agoGood point, it's depressingly common. It's not hard to DTRT though. Eg Docker install instructions have 4. Add the new GPG key. $ sudo apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys 58118E89F3A912897C070ADBF76221572C52609D