News for hackers. Stuff that matters.

A comment on Why does APT not use HTTPS?. Parent comment

Re:Why does APT not use HTTPS? by JdeBP on Monday January 21, 2019 @06:55AM (#18959727)
Even more precisely still, not even the lists of packages are signed. Only InRelease and Release are signed, and they only contain the list of Package files. It's FreeBSD that has the approach of just one signed file containing everything. APT has moved closer to it over the years, but it is not there yet.

* https://unix.stackexchange.com/a/332441/5132

[ Parent | on HN ]

There are no comments on this comment yet.