3 ms·
Considering that you are a DNS spoof away from installing packages from a compromised server, Virtually all package managers now verify package and/or metadata
by danieldk 8y ago
Considering that you are a DNS spoof away from installing packages from a compromised server,
Virtually all package managers now verify package and/or metadata signatures. If a server is spoofed and the system downloads a compromised package, the package manager will simply refuse to install it, because it is not signed by your distribution's packages.
Reproducible builds are useful because it reduces the probability of a compromised build system going undetected, by building the package on several independent builders.
For the user it also answers the question: does a distributor actually compile from the source code that they claim to compile from?
- Foxboron 8y agoArch Linux is also working on providing tools so our users can download a package, point a script at it and have the package recreated with all the info provided in .BUILDINFO. This includes the source location and a list of packages present on the system when the package was created. We are a couple of steps away from actually providing this, but we will hopefully get there soon enough.