pull: authenticate archive indexes against signed Release files

The Sources index was downloaded with no authentication: per-artifact
checksums were verified, but against hashes taken from an index a MITM
could substitute along with the artifacts. Fetch each suite's InRelease
(or Release + Release.gpg), verify the signature with gpgv against the
archive keyring (or the PPA signing key) the same way apt does, and
checksum-check every Sources index against it before parsing.

Distro archives and PPAs verify strictly: an invalid or unverifiable
signature, or a missing gpgv binary, is a hard error. Flat repositories
keep working without a Release file or without a verifiable one (warned
as unauthenticated), but tampering evidence is a hard error there too.

Also switches all archive, PPA and keyring base URLs to https, and
reads suite components from the verified Release instead of fetching
them separately over an unauthenticated channel.

This commit is contained in:

vhaudiquet

2026-09-16 01:22:22 +02:00

parent f508f20846

commit 213668fa82

5 changed files with 1431 additions and 11 deletions

									
										src/apt/mod.rs
									
		+2
		
												View File
												
				@@ -1,2 +1,4 @@

				pub mod keyring;

				/// Release-file signature and checksum verification for repositories

				pub mod release;

				pub mod sources;