3 ms·
Hopefully the PGP signatures are downloaded over TLS, at least.
by meowface 8y ago
Hopefully the PGP signatures are downloaded over TLS, at least.
- Xylakant 8y agoWhy would the signatures need to be downloaded via https? You need to get the keys via a trusted mechanism and the signing keys for a distribution are usually part of the install iso (which you should verify)
- meowface 8y agoSorry, I meant the PGP keys, not the signatures.
- Boulth 8y agoIf the keys are referenced by the key fingerprint they don't strictly need to be fetched over HTTPS. But the page that says "here's our fingerprint: xyz" would better be served over secure connection (assuming someone is not using WoT).
- meowface 8y agoTrue. When using PGP I'm used to just directly importing a public key listed somewhere. Either a key or its fingerprint (if one is provided) needs to be provided over a secure channel. But I guess it doesn't matter when the OS bundles the fingerprint or key and you're able to verify the OS image.
- tedunangst 8y agoIf PGP signatures require TLS, that's a serious problem with PGP.
- meowface 8y agoSorry, I meant the PGP keys, not the signatures.
- aaronmdjones 8y agoI see you meant keys, not signatures, so it's worth stating that the keys come with the distro when it is installed.
- meowface 8y agoThat's true, in which case I guess the "root" level of trust comes from validating the distro image's hash.