3 ms·
Why would the signatures need to be downloaded via https? You need to get the keys via a trusted mechanism and the signing keys for a distribution are usually p
by Xylakant 8y ago
Why would the signatures need to be downloaded via https? You need to get the keys via a trusted mechanism and the signing keys for a distribution are usually part of the install iso (which you should verify)
- meowface 8y agoSorry, I meant the PGP keys, not the signatures.
- Boulth 8y agoIf the keys are referenced by the key fingerprint they don't strictly need to be fetched over HTTPS. But the page that says "here's our fingerprint: xyz" would better be served over secure connection (assuming someone is not using WoT).
- meowface 8y agoTrue. When using PGP I'm used to just directly importing a public key listed somewhere. Either a key or its fingerprint (if one is provided) needs to be provided over a secure channel. But I guess it doesn't matter when the OS bundles the fingerprint or key and you're able to verify the OS image.