3 ms·
How good the signatures are if they are served from HTTP as well? It only serves as an integrity check, but it still won't guard you from a malicious person put
by M4v3R 12y ago
How good the signatures are if they are served from HTTP as well? It only serves as an integrity check, but it still won't guard you from a malicious person putting a virus into the package and adjusting the signatures.
- jahewson 12y agoThat won't work though, only the person who posses the private key can produce a valid GPG signature.
- rlpb 12y agoIf you're validating the signatures properly, then it's impossible for a malicious attacker to adjust the signatures in a way that they will still validate. However, validating the signature properly involves you being certain of using the correct public key. This is the tricky part. Being in the PGP strong set helps with this. Using HTTPS gives you some confidence, but no protection against server compromise. Once you do have the correct public key, however, you can be protected against server compromise for all future releases, too. Or, at the least, you can verify that future releases are coming unmodified from the same origin.