| |||||||||||||
|
| |||||||||||||
Study: Attacks on package managersStudy: Attacks on package managersPosted Jul 15, 2008 11:46 UTC (Tue) by job (subscriber, #670)In reply to: Study: Attacks on package managers by afalko Parent article: Study: Attacks on package managers
Are all the ebuilds cryptographically signed now? Last time I checked they were not. So the reason you needn't worry about the attacks described in the article is that the verifications aren't there in the first place.
(Log in to post comments)
Study: Attacks on package managers Posted Jul 17, 2008 8:08 UTC (Thu) by hickinbottoms (subscriber, #14798) [Link] No, they're not signed. This means the SHA1/MD5 checks only protect you from corruption during the download (or subsequently on disk, before the package has been built). You can prove this yourself - you can modify the downloaded package and regenerate those hashes with a "ebuild ... digest" command, so there's no secret to it. Portage is, I believe, quite vulnerable to compromised mirrors at present. I believe the groundwork to GPG-signing (not sure if that covers the package only, or whether it includes the metadata) has been done some time ago, but it's not progressed to the point where that's utilised yet.
|
|
||||||||||||