4 ms·
If archive.openwrt.org is like any other *nix package management software, it's likely that it doesn't need dnssec or tls. The signature of the packages get ver
by dastx 6y ago
If archive.openwrt.org is like any other *nix package management software, it's likely that it doesn't need dnssec or tls. The signature of the packages get verified based on predefined public keys. If the packages aren't signed by openwrt's private keys, the software will reject it.
You'll notice many other package management software do the exact same thing.
In any case, this is based on what other package management software does. I don't know if this is indeed the case.
- outsomnia 6y agoThat is indeed the theory. But the point here is how openwrt broke that "last / only line of defence" package signature check and nobody noticed for three years and two major releases.
- dastx 6y agoI am not aware of this. What happened?
- outsomnia 6y agoAs I linked above, introduced Feb 2017 found Jan 2020 https://openwrt.org/advisory/2020-01-31-1 https://openwrt.org/advisory/2020-01-31-1 A bug in the package list parse logic of OpenWrt's opkg fork caused the package manager to ignore SHA-256 checksums embedded in the signed repository index, effectively bypassing integrity checking of downloaded .ipk artifacts.