3

Neither archive.ubuntu.com nor *.archive.ubuntu.com have SSL encryption by default. That's danger and horrible, esp. for public servers, as hackers can pretend as archive.ubuntu.com and send debs with viruses. So, why, and can I connect to it via SSL?

Improve this question
1
  • The shortest answer is that apt's security design predates SSL. The medium-length answer is that there are several easier ways to get a poisoned package onto a system, so solving the problem is not a high priority. The longest answer is that most mirrors are not owned or controlled by Ubuntu, but by volunteers around the word -- Ubuntu (nor Canonical) can maintain the certificates on somebody else's server. Nevertheless, some mirrors DO offer SSL. Ubuntu welcomes workable, realistic community solutions to the latter two problems.
    – user535733
    May 17, 2022 at 4:09

1 Answer 1

Reset to default
8

APT is a secure packaging solution in which packages are signed with keys known only to Ubuntu and APT verifies the keys using public keys in APT's keyring on your system. This effectively provides end to end assurance that the package is unmodified by anyone outside of Ubuntu regardless of whether you obtained it from an official Ubuntu server or some mirror somewhere.

Ubuntu's repository system was built (as part of Debian) in a way so you don't have to trust the mirror you use, just that they didn't modify the package since it was signed internally by the distribution. This allows for the repository to be decentralized and for any volunteer to set up a mirror.

So, for example, you could use example.com as a mirror - if you were to use HTTPS and verify that you really are talking to example.com, it doesn't tell you anything useful, such as whether that mirror is approved by your distribution (Ubuntu) or whether that mirror modifies the packages after it gets them from Ubuntu to add viruses, it just tells you that you're talking to example.com. But APT's built in signature verification does provide these assurances.

APT does work over HTTPS and you can use HTTPS in an APT sources entry to apply another level of assurance to your connection (if the repository you're using supports it).

Improve this answer
3
  • Given the overhead of HTTPS isn't really much of a concern these days, I wouldn't be surprised if Ubuntu moved to using HTTPS for its default APT setups one day just because HTTPS is becoming somewhat the standard now. But this answer still points out why that isn't the main thing you need for verifying packages especially if using mirrors.
    – thomasrutter
    May 17, 2022 at 2:24
  • The main cons about not using https is the privacy. Do you mind providers and other systems to know what packages and versions are you using?
    – gavioto
    Jan 12 at 21:12
  • 1
    @gavioto I believe a study was done once that showed how it was possible in most cases to figure out what package someone downloaded by the size of it in bytes. Maybe modern https implementations do random padding or something, I don't know. At any rate, yes https will give you some privacy from MITMs "by default" and you may as well use it now in 2024, but freely available packages from open source operating systems was not high on the list of things needing privacy.
    – thomasrutter
    Jan 15 at 11:56

Not the answer you're looking for? Browse other questions tagged .