Y
HN Search
Hacker News Search
new
|
comments
|
top
|
jobs
pkgsupplysec
searching PlanetScale…
1.
▲
2.
▲
3.
▲
4.
▲
5.
▲
6.
▲
22 ms
·
1.
▲
by
pkgsupplysec
7y ago
And those package repo sha256 checksums are signed and verified with ed25519 by usign and ucert (with a key built into the firmware) usign: https://git.openwrt.org/project/usign.git ucert: https://git.openwr
2.
▲
by
pkgsupplysec
7y ago
It's definitely an issue that the sha256 checksum check was broken. But, can someone explain why a person who is MITM'ing ipk downloads would change the package and not the checksum? Are there GPG signatures of the package checksu