3 ms·
> Even in the case where you just obliviously add the repository's PGP key, you are protected against the file server being compromised. Unless you got the PGP
by kentonv 11y ago
> Even in the case where you just obliviously add the repository's PGP key, you are protected against the file server being compromised.
Unless you got the PGP key from the same file server, which is typical.
- zurn 11y agoGood point, it's depressingly common. It's not hard to DTRT though. Eg Docker install instructions have 4. Add the new GPG key. $ sudo apt-key adv --keyserver hkp://p80.pool.sks-keyservers.net:80 --recv-keys 58118E89F3A912897C070ADBF76221572C52609D