3 ms·
how does one know any signature they find is "good"?
by ranger_danger 1y ago
how does one know any signature they find is "good"?
- SV_BubbleTime 1y agoWe are in a perpetual loop of inefficient check methods, a bunch of steps, rediscovering what a supply chain attack is, a bunch of steps and just loop back over again.
- _def 1y agoGenerally speaking, a signature is cryptographically signed, when a checksum value is encrypted with the owners private key. The according public key should ideally be distributed in a chain-of-trust, so it can be obtained through a trusted channel.
- kwk1 1y agoIf you're using a Debian derivative these keys should be in packages distributed with your distro with trust coming from that
- SAI_Peregrinus 1y agoSince the distro's site was compromised you also have to check that any keys it distributes haven't changed. And that the compromise wasn't done by a legitimate maintainer.
- kwk1 1y agoThe packages in question don't come from the distro's homepage.