3 ms·
> If the apt repo was compromised (but the signing keys were not), this is very likely exactly the symptom that would appear. I don't think that's correct. It
by cjbprime 10y ago
> If the apt repo was compromised (but the signing keys were not), this is very likely exactly the symptom that would appear.
I don't think that's correct. It would pass a checksum test and fail a signature test with a "W: GPG Error". The checksum test is not about cryptographic security, it's just about files referenced by the Packages file having the same hash that the Packages file declares them to have. You don't need any signing keys to make that happen.
- 0x0 10y agoWhat's more suspicious: Bad hashes or bad signatures? What would an attacker choose if their goal was to get as many people as possible to force install?
- cjbprime 10y agoIt's impossible to force install the packages when they have bad hashes (hence the severe breakage here), and it is possible to install the packages when they have bad signatures if you didn't import the gpg key or don't run with signature checking. So I'd guess a rational attacker would choose a bad signature. But attackers can be irrational; it doesn't prove it's not an attack. Just not my intuition.