Arch Linux

tntcoda

Member

Registered: 2007-07-24

Posts: 115

Pacman Security Question

Hi,

I was just wondering if Pacman is ever likely to have more security built into it? Specfically I mean a way to garentee that packages which are updated from a mirror are legitimate in origin. Maybe some kind of digital certificate signing of packages?

Say for example, your DNS was compromised, and thus you cannot trust the mirror pacman is using, a malicious 3rd party can now issue an update that would be installed by root, giving potential full control of a box.

Is anything likely to be added to combat this kind of attack? Or is there already something in place ive missed?

Thanks,

Jack

muczyjoe

Member

From: Szeged (Hungary)

Registered: 2007-05-16

Posts: 45

Website

Re: Pacman Security Question

I'm interested too. Devs?

Allan

Pacman

From: Brisbane, AU

Registered: 2007-06-09

Posts: 11,473

Website

Re: Pacman Security Question

There is a bug report about it (http://bugs.archlinux.org/task/5331) and a start has been made on adding package signing to makepkg/pacman (http://code.toofishes.net/gitweb.cgi?p= … /heads/gpg) although I'm not sure how complete it is.

---

PGP Key: F99FFE0FEAE999BD | I develop pacman - buy me a drink!

skottish

Forum Fellow

From: Here

Registered: 2006-06-16

Posts: 7,942

Re: Pacman Security Question

There has been discussion about this recently:

http://bbs.archlinux.org/viewtopic.php?id=51570

tntcoda

Member

Registered: 2007-07-24

Posts: 115

Re: Pacman Security Question

Interesting thanks guys, will have a read through them

toofishes

Developer

From: Chicago, IL

Registered: 2006-06-06

Posts: 602

Website

Re: Pacman Security Question

There has been a lot of talk and little action on this front. Feel free to come join us on the pacman-dev mailing list to discuss and contribute, but none of the current developers are really interested in making it happen.