3 ms·

Does apt use tls by default today?

• beermonster 6y ago
  Apt supports TLS via apt-transport-https (as you are probably already aware) but I don't think it's default in either Debian nor (X)Ubuntu derivatives. I'd like to know why TBH. The packages themselves are signed though, so I guess the risk is now on server authenticity as opposed to package integrity.
  • pabs3 6y ago
    The packages are not signed, but there is a hash chain from the signed Release files through to the packages themselves.
    • beermonster 6y ago
      Yes you are right, I stand corrected. Here is an explanation of the process under 'The current scheme for package signature checks' at the following url https://www.debian.org/doc/manuals/securing-debian-manual/deb-pack-sign.en.html https://www.debian.org/doc/manuals/securing-debian-manual/de....