vhaudiquet
213668fa82
The Sources index was downloaded with no authentication: per-artifact checksums were verified, but against hashes taken from an index a MITM could substitute along with the artifacts. Fetch each suite's InRelease (or Release + Release.gpg), verify the signature with gpgv against the archive keyring (or the PPA signing key) the same way apt does, and checksum-check every Sources index against it before parsing. Distro archives and PPAs verify strictly: an invalid or unverifiable signature, or a missing gpgv binary, is a hard error. Flat repositories keep working without a Release file or without a verifiable one (warned as unauthenticated), but tampering evidence is a hard error there too. Also switches all archive, PPA and keyring base URLs to https, and reads suite components from the verified Release instead of fetching them separately over an unauthenticated channel.
29 lines
1.2 KiB
YAML
29 lines
1.2 KiB
YAML
## Static data needed for pkh operations
|
|
## Instead of hardcoding the data in code, data files allow to quickly
|
|
## update and maintain such data in one unique place
|
|
## The goal is to have the minimal possible set of data necessary
|
|
## to grab the actual data. For example we don't want to store every Ubuntu
|
|
## or Debian series, but rather an URL where we can properly access that data.
|
|
dist_info:
|
|
local: /usr/share/distro-info/{dist}
|
|
network: https://salsa.debian.org/debian/distro-info-data/-/raw/main/
|
|
dist:
|
|
debian:
|
|
base_url: https://deb.debian.org/debian
|
|
archive_keyring: https://ftp-master.debian.org/keys/archive-key-{series_num}.asc
|
|
pockets:
|
|
- proposed-updates
|
|
- updates
|
|
series:
|
|
local: /usr/share/distro-info/debian.csv
|
|
network: https://salsa.debian.org/debian/distro-info-data/-/raw/main/debian.csv
|
|
ubuntu:
|
|
base_url: https://archive.ubuntu.com/ubuntu
|
|
archive_keyring: https://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg
|
|
pockets:
|
|
- proposed
|
|
- updates
|
|
series:
|
|
local: /usr/share/distro-info/ubuntu.csv
|
|
network: https://salsa.debian.org/debian/distro-info-data/-/raw/main/ubuntu.csv
|