Date: Mon, 22 Oct 2007 10:07:33 +0800 From: "Adrian Chadd" <adrian@freebsd.org> To: "David E. Thiel" <lx@freebsd.org> Cc: freebsd-hackers@freebsd.org Subject: Re: packages, libfetch, and SSL Message-ID: <d763ac660710211907p5b23e145o62da8a5661b6b902@mail.gmail.com> In-Reply-To: <20071021013917.GB86865@redundancy.redundancy.org> References: <20071021013917.GB86865@redundancy.redundancy.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 21/10/2007, David E. Thiel <lx@freebsd.org> wrote: > > The lowest-impact way to fix this, I think, is to use SSL for pkg_adds. > There are a couple of things that would need to change to make this > happen. You can't (easily) cache data over SSL. Well, you can't use a HTTP proxy that doesn't break the SSL conversation and cache the updates. As someone who occasionally makes sure that distribution updates through a Squid proxy actually caches said updates, I'd really prefer you didn't stick package contents behind SSL. > Now, we could take another approach of PGP-signing packages instead, but > all the efforts I've seen to integrate PGP with the package management > system in the past haven't gone anywhere. The changes above seem to be > a bit more trivial than inventing a package-signing infrastructure and > putting gpg or a BSD-licensed clone into base. Perhaps using SSL to sign > packages and having a baked-in key would work as well. Considering its a solved problem (mostly!) in other distributions, and their updates are very cachable, why not do this? Adrian -- Adrian Chadd - adrian@freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?d763ac660710211907p5b23e145o62da8a5661b6b902>