News for hackers. Stuff that matters.

A comment on Why does APT not use HTTPS?. Parent comment

Re:Why does APT not use HTTPS? by philjohn on Monday January 21, 2019 @05:24AM (#18959281)
They cover this - timestamps are embedded in the packages, and also signed. If they're too old it won't update and you'll know something is amiss.
[ Parent | on HN ]
Re:Why does APT not use HTTPS? by na412 on Monday January 21, 2019 @05:55AM (#18959438)
More precisely, an expiration timestamp is embedded in the repository metadata.

Packages in debian and derivatives are not signed. Instead, the manifest that lists all the available packages and their checksums is signed. That's also where the expiration data is stored.

[ Parent | on HN ]
Re:Why does APT not use HTTPS? by JdeBP on Monday January 21, 2019 @06:55AM (#18959727)
Even more precisely still, not even the lists of packages are signed. Only InRelease and Release are signed, and they only contain the list of Package files. It's FreeBSD that has the approach of just one signed file containing everything. APT has moved closer to it over the years, but it is not there yet.

* https://unix.stackexchange.com/a/332441/5132

[ Parent | on HN ]