4 ms·
Apt supports TLS via apt-transport-https (as you are probably already aware) but I don't think it's default in either Debian nor (X)Ubuntu derivatives. I'd like
by beermonster 6y ago
Apt supports TLS via apt-transport-https (as you are probably already aware) but I don't think it's default in either Debian nor (X)Ubuntu derivatives. I'd like to know why TBH.
The packages themselves are signed though, so I guess the risk is now on server authenticity as opposed to package integrity.
- pabs3 6y agoThe packages are not signed, but there is a hash chain from the signed Release files through to the packages themselves.
- beermonster 6y agoYes you are right, I stand corrected. Here is an explanation of the process under 'The current scheme for package signature checks' at the following url https://www.debian.org/doc/manuals/securing-debian-manual/deb-pack-sign.en.html https://www.debian.org/doc/manuals/securing-debian-manual/de....