docs: install APT from deb.snapdog.cc, with a checked key - #47
Open
metaneutrons wants to merge 1 commit into
Open
docs: install APT from deb.snapdog.cc, with a checked key#47metaneutrons wants to merge 1 commit into
metaneutrons wants to merge 1 commit into
Conversation
Two things were wrong on this page, and the second matters more than the move. The address was the old `gh-pages` repository, frozen at 0.27.4 since the packages moved to the shared archive at `deb.snapdog.cc`. And the sources line carried `[trusted=yes]`. That switches off signature verification altogether: apt then installs whatever answers at that URL, which is the one thing a signed repository exists to prevent. The page now fetches the archive keyring, has the reader compare its fingerprint, and binds the source to that key with `signed-by`. The sequence was executed verbatim in a clean Debian container against the sibling archive `deb.metaneutrons.cc`, which already publishes. Only the domain and the package names differ; `deb.snapdog.cc` publishes for the first time with the next snapdog release.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two things were wrong on this page, and the second matters more than the move.
The address was the old
gh-pagesrepository, frozen at 0.27.4 since thepackages moved to the shared archive at
deb.snapdog.cc.And the sources line carried
[trusted=yes]. That switches off signatureverification altogether: apt then installs whatever answers at that URL, which
is the one thing a signed repository exists to prevent. The page now fetches the
archive keyring, has the reader compare its fingerprint, and binds the source to
that key with
signed-by.The sequence was executed verbatim in a clean Debian container against the
sibling archive
deb.metaneutrons.cc, which already publishes. Only the domainand the package names differ;
deb.snapdog.ccpublishes for the first time withthe next snapdog release.