3 ms·

Most Linux package managers use GPG signed packages.

by adestefan 13y ago

gaadd33 13y ago
Right but if you are downloading an ISO you still have to manually verify it correct?
- lifeisstillgood 13y ago
  yes but a one time md5 of an iso is far less strenuous than manually checking the provenance of 200 tarballs to build say X. there is a new package management system similar to apt-get but it's far rarer to see it used than ports I really like ports - as much for the knowledge that I have all the right header files.
  - gaadd33 13y ago
    When do you have to check the provenance of 200 tarballs to install X? If you install from an ISO, you can install the ports from there too and you have checksums which are automatically checked, right? So if you do cd /usr/ports/x11-wm/xfce4; make install it will automatically check all of the checksums right?
    - lifeisstillgood 13y ago
      err, maybe. I don't think I have ever installed x from pkgs on cd. I always download thru ports - the 200 tarballs was what ports does for me (downloads and verifies md5) so if I did not use ports and I did build from source I would manually download and verify. I don't think anyone would ever do that admittedly.
profquail 13y ago
In FreeBSD (and the other BSDs), packages and ports are two separate things. Packages are binary distributions; a port is just a set of patches (if necessary) and a special makefile telling the build system where to download the sources for the software you want to build and any special instructions necessary to build/install it. It makes sense to sign packages, but not ports. Ports do contain checksum files though, to make sure the source tarball/zip you download hasn't been changed -- this is what 'gaadd33' was referring to.
- adestefan 13y ago
  Very few Linux distributions have the equivalent of FreeBSD's ports. I know of the Arch Linux AUR and they also use checksums in their PKGBUILD files.

3 ms·

Most Linux package managers use GPG signed packages.

by adestefan 13y ago

Most Linux package managers use GPG signed packages.

gaadd33 13y ago
Right but if you are downloading an ISO you still have to manually verify it correct?
- lifeisstillgood 13y ago
  yes but a one time md5 of an iso is far less strenuous than manually checking the provenance of 200 tarballs to build say X. there is a new package management system similar to apt-get but it's far rarer to see it used than ports I really like ports - as much for the knowledge that I have all the right header files.
  - gaadd33 13y ago
    When do you have to check the provenance of 200 tarballs to install X? If you install from an ISO, you can install the ports from there too and you have checksums which are automatically checked, right? So if you do cd /usr/ports/x11-wm/xfce4; make install it will automatically check all of the checksums right?
    - lifeisstillgood 13y ago
      err, maybe. I don't think I have ever installed x from pkgs on cd. I always download thru ports - the 200 tarballs was what ports does for me (downloads and verifies md5) so if I did not use ports and I did build from source I would manually download and verify. I don't think anyone would ever do that admittedly.
profquail 13y ago
In FreeBSD (and the other BSDs), packages and ports are two separate things. Packages are binary distributions; a port is just a set of patches (if necessary) and a special makefile telling the build system where to download the sources for the software you want to build and any special instructions necessary to build/install it. It makes sense to sign packages, but not ports. Ports do contain checksum files though, to make sure the source tarball/zip you download hasn't been changed -- this is what 'gaadd33' was referring to.
- adestefan 13y ago
  Very few Linux distributions have the equivalent of FreeBSD's ports. I know of the Arch Linux AUR and they also use checksums in their PKGBUILD files.