3 ms·
> a mirror could hypothetically replace the package with another (potentially malicious) package, leading users to install malicious tooling. It was my assumpt
by yellow_lead 2y ago
> a mirror could hypothetically replace the package with another (potentially malicious) package, leading users to install malicious tooling.
It was my assumption that a mirror is required to host a build that has a hash conforming to the original. Is that not the case?
- gruez 2y agoMore specifically the packages are signed by the distro and automatically checked, so a mirror can't go rogue even if it wanted to.
- jerf 2y agoYes, the real attack isn't that mirrors change the files, the real attack is that just because a distro packages Binary X and Source X, it is difficult without reproducible builds to prove that Source X actually did produce Binary X. It could have been compiled with a trojan in it between the source and binary.