6 ms·
Almost every modern distro verifies package files by PGP signatures (either directly, or a signature that covers a file that contains a list of hashes, or a sig
by aaronmdjones 8y ago
Almost every modern distro verifies package files by PGP signatures (either directly, or a signature that covers a file that contains a list of hashes, or a signature that covers a tarball which extracts a file containing a list of hashes, whatever you fancy).
TLS for downloading won't provide authentication anyway, seeing as anyone can run mirrors and serve whatever malicious content they like.
- meowface 8y agoHopefully the PGP signatures are downloaded over TLS, at least.
- Xylakant 8y agoWhy would the signatures need to be downloaded via https? You need to get the keys via a trusted mechanism and the signing keys for a distribution are usually part of the install iso (which you should verify)
- meowface 8y agoSorry, I meant the PGP keys, not the signatures.
- Boulth 8y agoIf the keys are referenced by the key fingerprint they don't strictly need to be fetched over HTTPS. But the page that says "here's our fingerprint: xyz" would better be served over secure connection (assuming someone is not using WoT).
- meowface 8y agoTrue. When using PGP I'm used to just directly importing a public key listed somewhere. Either a key or its fingerprint (if one is provided) needs to be provided over a secure channel. But I guess it doesn't matter when the OS bundles the fingerprint or key and you're able to verify the OS image.
- tedunangst 8y agoIf PGP signatures require TLS, that's a serious problem with PGP.
- meowface 8y agoSorry, I meant the PGP keys, not the signatures.
- aaronmdjones 8y agoI see you meant keys, not signatures, so it's worth stating that the keys come with the distro when it is installed.
- meowface 8y agoThat's true, in which case I guess the "root" level of trust comes from validating the distro image's hash.
- bitofhope 8y agoA friend once tried to update Arch Linux on a wifi behind a captive portal. Pacman broke because instead of a package list it downloaded the captive portal login page and failed to parse it, leading to mystery hunt for my friend troubleshooting the issue. With an HTTPS mirror it would have just failed to connect or handshake with the mirror.
- GranPC 8y agoThat sounds like HTTPS would be an usability improvement, but not necessarily a security improvement.
- zaarn 8y agoTLS downloading would provide an improvement in privacy and prevent every random person in the same wifi network as you or along the long chain of connections from trying to maliciously tamper with contents.
- angry_octet 8y agoAnd also prevents seeing which package versions you use. Some networks have ridiculous content inspection to filter out 'bad' executables like Wireshark. Basically, TLS is the best way to stop mitm of all sorts.