Re:Why does APT not use HTTPS?
by LeonidasXIV on Monday January 21, 2019 @06:11AM
(#18959523)
It didn't used to support it not too long ago so I had to setup my server to explicitly not redirect to HTTPS for one particular location because people would need to install apt-transport-https for it.
[ Parent
| on HN ]
Re:Why does APT not use HTTPS?
by newaccoutnas on Monday January 21, 2019 @08:52AM
(#18960350)
It's been in there for years
EDIT: Over 12 years to be precise.
* added apt-transport-https method
it was in a secondary package for a long time though (until apt 1.5 in 2017)
So in order to get the HTTPS transport, you needed to first download the required package over HTTP.
Re:Why does APT not use HTTPS?
by newaccoutnas on Monday January 21, 2019 @05:15PM
(#18964133)
We used FAI[1] to install it into the boot images we used and then ran it that way (other methods), but there still is the verification of the packages you put on those. Short of manually auditing the code and compiling that yourself then there's not much else in the trust chain. It's not really that necessary though, realistically, with the other protection methods. We just did it as it was fun to do and well, we could!