409
Flathub now marks unverified apps (lemmy.ml)
submitted 8 months ago by mr_MADAFAKA@lemmy.ml to c/linux@lemmy.ml
50 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[-] delirious_owl@discuss.online 12 points 7 months ago

So all of them?

Would be nice if FlatHub actually supported cryptographic verification of apps..

[-] AProfessional@lemmy.world 2 points 7 months ago

Flathubs repository’s is GPG signed.

[-] delirious_owl@discuss.online 1 points 7 months ago

Nope. Link me to the docs that say this.

[-] AProfessional@lemmy.world 1 points 7 months ago

The GPG key is literally in the repo file https://dl.flathub.org/repo/flathub.flatpakrepo

[-] delirious_owl@discuss.online 1 points 7 months ago

Lol that's not for signing the packages

[-] AProfessional@lemmy.world 1 points 7 months ago

There is no such thing as a “package”. It is a repository of binary data with references to data in it (ala git). The whole repo and all data is gpg signed.

[-] delirious_owl@discuss.online 1 points 7 months ago* (last edited 7 months ago)

Your claim that package payloads are signed is bullshit. Back it up by citing your sources

[-] AProfessional@lemmy.world 1 points 7 months ago 
> ostree show flathub:runtime/org.kde.Platform/x86_64/6.6
commit a7443e846cf67d007fcecda5c9dc27844001cfb8929064395cfc25c6d71d9474
Parent:  23107550082daf3b2892a4a0db2543838578ca882340a756b988bc5c1614540c
ContentChecksum:  607ba9475d32a24c51509bc7919f5a93d401f8f7198c30ad93ad74051d966c41
Date:  2024-01-30 13:55:08 +0000

    build of org.kde.Sdk, Tue Jan 30 11:23:00 UTC 2024 (5998d2f3ef21414d14f066ab91fa44e5aef65b90)

    Name: org.kde.Platform
    Arch: x86_64
    Branch: 6.6
    Built with: Flatpak 1.14.4

Found 1 signature:

  Signature made Tue 30 Jan 2024 12:21:18 PM CST using RSA key ID 562702E9E3ED7EE8
  Good signature from "Flathub Repo Signing Key <flathub@flathub.org>"
  Primary key ID 4184DD4D907A7CAE
  Key expires Mon 14 Jun 2027 08:19:40 AM CDT
  Primary key expires Mon 14 Jun 2027 08:18:56 AM CDT
[-] delirious_owl@discuss.online 1 points 7 months ago

And what happens if I mitm you and you get something unsigned? Does it ignore it and proceed?

This is why in asking for the docs that describe the security

[-] AProfessional@lemmy.world 1 points 7 months ago

GPG errors are fatal unless you manually configure the repo to ignore them with an obscure command.

[-] delirious_owl@discuss.online 2 points 7 months ago

Please link to the docs

this post was submitted on 28 Mar 2024
409 points (100.0% liked)

Linux

48332 readers
572 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
AgreeableLandscape@lemmy.ml
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz