How is the origin of packages secured?

asked 2016-12-02 01:14:07 +0200

DarkTuring gravatar image

updated 2016-12-02 15:25:59 +0200

chemist gravatar image

How does Jolla protect packages sent from Jolla server to a client instance during pkcon install process from being intercepted by a middleman or being tampered with? How are signatures shared and verified, hash verification during download to user?

edit retag flag offensive close delete

Comments

3

Take at look at what SUSE does, Sailfish uses their programs for handling the RPMs. Anyway, RPM sucks hard...

PS: I would recommend changing the title, it implies that a security issue was discovered 'How are packages and apps verified?'

hoschi ( 2016-12-02 09:04:00 +0200 )edit
3

@hoschi whilst I agree that rpm can suck hard, there's plenty of reasons why the rest out there sucks even more.

tortoisedoc ( 2016-12-02 09:25:33 +0200 )edit
1

If TAR (pacman or pkgtool) or even DEB (apt) sucks more than RPM, the hell will freeze.

hoschi ( 2016-12-02 19:55:50 +0200 )edit
2

Most distros (such as Fedora) sign their packages and the have the package manager verify the signature before installation. If the package was tempered with (or even just corrupted) during transfer, the signature will be different and the package will be rejected.

I assume Sailfish OS does the same thing as not doing it would be rather insane, but an official confirmation would be nice. :)

MartinK ( 2016-12-02 21:05:51 +0200 )edit