Solved pkg mirror safety

That only checks if the dependencies are in order. That doesn't mean the package itself is safe though, who's to say that package doesn't contain a backdoor? Using packages from untrusted sources is inherently unsafe.
 
jronald said:
How to assure that the packages are safe?
Click to expand...
The one who is talking "safe" has to make transparent what he is thinking of.
Security in IT is not a state but a process keeping in mind that there never will something like enduring security.

If you need to trust on something you may feel safe but you are not necessarily safe by any means.

Downloading binaries comes at a price as ease does not match security.
Official mirrors may be safer than wild ones, but that does not mean you are safe using them.

So if you cannot afford the luxury downloading binary blubs you need to build them yourself. That can be done and fortunately FreeBSD makes it not difficult to do.
 
SirDice said:
That only checks if the dependencies are in order. That doesn't mean the package itself is safe though, who's to say that package doesn't contain a backdoor? Using packages from untrusted sources is inherently unsafe.
Click to expand...


I have misunderstood the doc.

pkg help check
pkg check -s or pkg check --checksums detects installed packages with invalid checksums. An invalid checksum can be caused by data corruption
or tampering.
Click to expand...
 
If FreeBSD provides build option and corresponding checksum for each pkg binary, it'll be good for third party supports.
 
You must log in or register to reply here.
Back
Top