Package Signing Security
Discussions center on cryptographic signing (GPG, PGP) for verifying software packages in package managers and repositories like Linux distros, npm, and others, debating trust, mirror security, and comparisons to checksums.
Activity Over Time
Top Contributors
Keywords
Sample Comments
Packages are signed, unless you're using a niche, insecure distro or package manager. Of course, that signing key could also be compromised, but those are usually more tightly guarded than web servers, which are compromised rather more frequently (any reputable dev should have their key in a hardware enclave like yubikey or similar).
how likely is it that npm and other package managers that do not use digital signatures by default are unaffected?
Are packages cryptographically signed by the actual package maintainer or only with the repo owners key?
Unless you verify against a PGP signature with trusted keys.
The downloads are all GPG-signed, so that shouldn't be an issue. You have the issue of the initial trust, but that applies to HTTPS too to a lesser extent.
Yes it is a real concern. If you're running a Linux distribution, chances are you are downloading your packages from a mirror and not the primary mirror for your distribution. This is done to everyone's benefit bandwidth-wise.However it opens up the possibility that the artefacts can be tampered with on the server. Signing confirms their authenticity. In a (cryptographically secure) hash, there is no 'key' and so anyone can create a valid one for their modified bundle.D
That would be pretty annoying.The signatures are an end-to-end thing. As long as you can trust the signer at time of signing, you can trust the package. No matter what happened to that package in the meantime, or what shady people were in charge of transmitting it to you. Be that five minutes after uploading or fifty years.2FA and HTTPS only do anything extra on top of that for you, if you trust the whole chain of transmission at all times, and all custodians of the data.Adding 2FA a
You know that packages are signed right? That's why everyone can be a libreoffice or ArchLinux Mirror...or Fedora?
Why not even a PGP signature from the team? At least the public keys can be pinned so the possible compromise can be detected. I think Arch does something like that.
The signatures and binaries are not served over HTTPS. It would be prudent to compare them to other sources.