mr_MADAFAKA@lemmy.ml to Linux@lemmy.ml · 9 months agoFlathub now marks unverified appslemmy.mlimagemessage-square68fedilinkarrow-up1428arrow-down17
arrow-up1421arrow-down1imageFlathub now marks unverified appslemmy.mlmr_MADAFAKA@lemmy.ml to Linux@lemmy.ml · 9 months agomessage-square68fedilink
minus-squareAProfessional@lemmy.worldlinkfedilinkEnglisharrow-up1·9 months agoThe GPG key is literally in the repo file https://dl.flathub.org/repo/flathub.flatpakrepo
minus-squaredelirious_owllinkfedilinkarrow-up1arrow-down2·9 months agoLol that’s not for signing the packages
minus-squareAProfessional@lemmy.worldlinkfedilinkEnglisharrow-up1·9 months agoThere is no such thing as a “package”. It is a repository of binary data with references to data in it (ala git). The whole repo and all data is gpg signed.
minus-squaredelirious_owllinkfedilinkarrow-up1arrow-down1·edit-29 months agoYour claim that package payloads are signed is bullshit. Back it up by citing your sources
minus-squareAProfessional@lemmy.worldlinkfedilinkEnglisharrow-up1·9 months ago> ostree show flathub:runtime/org.kde.Platform/x86_64/6.6 commit a7443e846cf67d007fcecda5c9dc27844001cfb8929064395cfc25c6d71d9474 Parent: 23107550082daf3b2892a4a0db2543838578ca882340a756b988bc5c1614540c ContentChecksum: 607ba9475d32a24c51509bc7919f5a93d401f8f7198c30ad93ad74051d966c41 Date: 2024-01-30 13:55:08 +0000 build of org.kde.Sdk, Tue Jan 30 11:23:00 UTC 2024 (5998d2f3ef21414d14f066ab91fa44e5aef65b90) Name: org.kde.Platform Arch: x86_64 Branch: 6.6 Built with: Flatpak 1.14.4 Found 1 signature: Signature made Tue 30 Jan 2024 12:21:18 PM CST using RSA key ID 562702E9E3ED7EE8 Good signature from "Flathub Repo Signing Key <flathub@flathub.org>" Primary key ID 4184DD4D907A7CAE Key expires Mon 14 Jun 2027 08:19:40 AM CDT Primary key expires Mon 14 Jun 2027 08:18:56 AM CDT
minus-squaredelirious_owllinkfedilinkarrow-up1arrow-down1·9 months agoAnd what happens if I mitm you and you get something unsigned? Does it ignore it and proceed? This is why in asking for the docs that describe the security
minus-squareAProfessional@lemmy.worldlinkfedilinkEnglisharrow-up1·9 months agoGPG errors are fatal unless you manually configure the repo to ignore them with an obscure command.
The GPG key is literally in the repo file https://dl.flathub.org/repo/flathub.flatpakrepo
Lol that’s not for signing the packages
There is no such thing as a “package”. It is a repository of binary data with references to data in it (ala git). The whole repo and all data is gpg signed.
Your claim that package payloads are signed is bullshit. Back it up by citing your sources
> ostree show flathub:runtime/org.kde.Platform/x86_64/6.6 commit a7443e846cf67d007fcecda5c9dc27844001cfb8929064395cfc25c6d71d9474 Parent: 23107550082daf3b2892a4a0db2543838578ca882340a756b988bc5c1614540c ContentChecksum: 607ba9475d32a24c51509bc7919f5a93d401f8f7198c30ad93ad74051d966c41 Date: 2024-01-30 13:55:08 +0000 build of org.kde.Sdk, Tue Jan 30 11:23:00 UTC 2024 (5998d2f3ef21414d14f066ab91fa44e5aef65b90) Name: org.kde.Platform Arch: x86_64 Branch: 6.6 Built with: Flatpak 1.14.4 Found 1 signature: Signature made Tue 30 Jan 2024 12:21:18 PM CST using RSA key ID 562702E9E3ED7EE8 Good signature from "Flathub Repo Signing Key <flathub@flathub.org>" Primary key ID 4184DD4D907A7CAE Key expires Mon 14 Jun 2027 08:19:40 AM CDT Primary key expires Mon 14 Jun 2027 08:18:56 AM CDTAnd what happens if I mitm you and you get something unsigned? Does it ignore it and proceed?
This is why in asking for the docs that describe the security
GPG errors are fatal unless you manually configure the repo to ignore them with an obscure command.
Please link to the docs