4 ms·

It's hard to believe that Alpine is "very security focused", when both the .iso and checksums are served over http/have no https forced.

• aidenn0 10y ago
  The ISOs are GPG signed.
  • iyn 10y ago
    True, but public key is also send with http by default and signature doesn't even have proper https. It is possible to securely verify the integrity etc (e.g by using keyservers), but Alpine doesn't help with this at all.