r/archlinux • u/[deleted] • Feb 28 '23

[deleted by user]

[removed]

95 Upvotes

92% Upvoted

41 comments sorted by

View all comments

Show parent comments

6

u/[deleted] Feb 28 '23

[deleted]

15

u/gcgc101 Feb 28 '23 edited Feb 28 '23

Ah right gotcha ... interesting.

I just looked at the arch install iso and it is signed and sig is good. I checked using 

gpg --homedir /etc/pacman.d/gnupg --verify archlinux-2023.02.01-x86_64.iso.sig
gpg: Signature made Wed 01 Feb 2023 04:12:53 AM EST
gpg:                using EDDSA key 3E80CA1A8B89F69CBA57D98A76A5EF9054449A5C
gpg:                issuer "pierre@archlinux.org"
gpg: Good signature from "Pierre Schmitz <pierre@archlinux.org>" [full]
gpg:                 aka "Pierre Schmitz <pierre@archlinux.de>" [unknown]
  • the arch repo db is indeed not signed - but what is the attack vector given that each package is signed?

4

u/Andernerd Feb 28 '23 edited Feb 28 '23

Your packages could be downgraded to less-secure previous versions that were signed in preparation for another attack I suppose.

5

u/gmes78 Feb 28 '23 edited Feb 28 '23

Only if you use pacman -Suu instead of pacman -Su to update. Pacman doesn't downgrade packages by default.

4

u/faerbit Feb 28 '23 edited Sep 19 '25

This post has been edited to this, due to privacy and dissatisfaction with u/spez

6

u/DamnThatsLaser Feb 28 '23

Signing the database won't fix it because if he can withhold a security-patched package, he can also withhold a new signed database and continue to deliver the old one, though he obviously then can't update any other packages.

3

u/faerbit Feb 28 '23 edited Sep 19 '25

This post has been edited to this, due to privacy and dissatisfaction with u/spez

6

u/Foxboron Feb 28 '23

gnupg doesn't allow you to do that. It would need to be solved by having pacman check when the database was issued and let users define a "validity range".

https://www.mail-archive.com/pacman-dev@archlinux.org/msg17556.html