Sigstore protects Apt archives: apt-verify and apt-sigstore

Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by DethNinja on Sunday April 16, 2023 @10:38AM (#35590394)

Hash verification is extremely important to protect against supply chain attacks on apt.

Also, apt itself is supposed to be protected by distro’s key, but did any distro ever wrote how master keys are securely stored? Is there any other reasonable way to know that apt and entire Linux supply chain hasn’t been compromised already?

[ Parent | on HN ]

Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by madwebness on Sunday April 16, 2023 @11:46AM (#35591038)

I would very much like to hear an answer to that from somebody who understands the subject deeply. Honestly, these days, I use containers for almost anything unusual and I don't update much either - precisely because anything you install with `apt` would have access to ALL of your system or at least limited access in read-only mode for some files and directories. And I would like to know if anyone can answer the same question for FreeBSD.

[ Parent | on HN ]

Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by bombolo on Sunday April 16, 2023 @06:07PM (#35594706)

docker by default gives root access.

[ Parent | on HN ]