3 ms·
I can think of at least one vector. Suppose a particular library announces one generic repository as their approved distribution channel. Suppose the repo does
by asdfasgasdgasdg 7y ago
I can think of at least one vector. Suppose a particular library announces one generic repository as their approved distribution channel. Suppose the repo does not do any vetting on what gets uploaded. In this circumstance, you'd only want to pull that particular package from the repo, not any arbitrary package.
So I think the trust model bears scoping. It's not all or nothing.
- geofft 7y agoIs there any apt repo software that permits multiple parties to upload to a repo but also enforces that people can't upload new versions of other people's packages? As it happens, Debian itself kinda does this (Debian "maintainers" can only upload to specific package names), but I don't think anyone else runs that software. The usual third-party repo tools like reprepro and aptly don't support it, as far as I know. And sites like Launchpad or OBS just set up a separate apt repo per account (or even multiple apt repos per account), because doing that is very easy. In other words - yes, the trust model you propose is coherent, but I don't think anyone actually does that, because there's a more straightforward option already.
- andrewshadura 7y agoActually, both reprepro and aptly support this.
- roenxi 7y agoThe apt trust model is overly simplistic but it is so hard to come up with a safe model that I don't see how it matters. And if a repository added for a specific package might be compromised then there might be a malicious version of that package already in the repo. Once you have to verify the versions and hashes by hand you may as well download the debs directly & use dpkg.