2 ms·
Linux repos are expected to use cache-friendly methods but not restricted from also using a secure transport. Security of the objects is obtained from GPG sign
by LinuxBender 4y ago
Linux repos are expected to use cache-friendly methods but not restricted from also using a secure transport. Security of the objects is obtained from GPG signing of individual packages and GPG signing of the repository meta-data. The risk comes from GPG keys being on the cached repositories rather than only existing on a trusted source and I have seen people install GPG keys from mirrors. I tried and failed for example to convince Redhat to stop putting the public keys on the mirrors. Many companies mirror their secondary community hosted mirrors internally to build systems and are prime candidates for take-over and GPG re-signing.
- Avamander 4y agoGPG's track record of being robust against attacks is not that great, not to mention the complexity and surface of HTTP stacks. It would be great to make that attack surface available only to malicious mirrors.
- LinuxBender 4y agoIt would be great to make that attack surface available only to malicious mirrors. That is exactly why I was pushing to remove the keys from the mirrors but unofficially it's too late as any changes could cause disruptions for people that have private internal mirrors. I suggested just communicating the change for a year prior which would have occurred years in the past as of now.