Re: apt download security?
On Tue, 7 Nov 2000, Bruce Richardson wrote:
> Unfortunately, while source packages can be checked quite easily, they
> are not always verifiable. There is no simple mechanism for verifying
> debs *at all*. Nor even Packages.gz - and the integrity of Packages.gz
> isn't actually a guarantee of the integrity of any of the packages.
Er we can provide a 'ssl-like' assurance for the Packages.gz which will
rule out any bad mirror from forging .debs
It is much harder to prevent attacks from people with root on our primary
box however!
Jason
Reply to: