Taming the BPF Superpowers

Re:Taming the BPF Superpowers by GordonS on Sunday October 10, 2021 @12:48PM (#28819846)

Ah, cool, I didn't know that. Do you know if it uses public key signatures, or if it's simply a list of known hashes for each file of each version?

[ Parent | on HN ]

Re:Taming the BPF Superpowers by dfghdfgj on Sunday October 10, 2021 @01:59PM (#28820528)

This applies to almost all modern linux package managers.

PGP is typically used to sign a collection of hashes (and other metadata). PGP is generally only used at package install/build time, and the subsequently installed/generated manifest is used when you ask the package manager to verify the package.

[ Parent | on HN ]

Re:Taming the BPF Superpowers by marbu on Sunday October 10, 2021 @04:57PM (#28821921)

It just compares expected checksum from rpm database with actual state in the system.

That said, rpm supports package signing, so that it can catch a package which was tampered with and prevent it's installation.

[ Parent | on HN ]