7 ms·
In practice, Debian downloads your packages over HTTPS from reliable trusted parties. HTTPS is the real, actual defense against package manipulation. The PGP si
by dfabulich 6y ago
In practice, Debian downloads your packages over HTTPS from reliable trusted parties. HTTPS is the real, actual defense against package manipulation. The PGP signatures do nothing, but they don't really need to work; that's why nobody's bothered to fix them.
- anderskaseorg 6y agoNo, a default Debian installation downloads packages over plain HTTP. It doesn’t even support downloading packages over HTTPS unless you install the optional apt-transport-https package and edit your sources.list. It uses SHA-2 checksums since Debian 9, though.
- pabs3 6y agohttps cannot protect you from malicious apt mirrors or CDN node operators.