Why does APT not use HTTPS?

Re:Why does APT not use HTTPS? by newaccoutnas on Monday January 21, 2019 @08:52AM (#18960350)

It's been in there for years

EDIT: Over 12 years to be precise.

  * added apt-transport-https method

Fri, 12 Jan 2007 20:48:07 +0100

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by pilif on Monday January 21, 2019 @11:00AM (#18961185)

it was in a secondary package for a long time though (until apt 1.5 in 2017)

So in order to get the HTTPS transport, you needed to first download the required package over HTTP.

[ Parent | on HN ]

Re:Why does APT not use HTTPS? by newaccoutnas on Monday January 21, 2019 @05:15PM (#18964133)

We used FAI[1] to install it into the boot images we used and then ran it that way (other methods), but there still is the verification of the packages you put on those. Short of manually auditing the code and compiling that yourself then there's not much else in the trust chain. It's not really that necessary though, realistically, with the other protection methods. We just did it as it was fun to do and well, we could!

[1] https://fai-project.org/

[ Parent | on HN ]