SliTaz Forum

AnhHuynh

Member

Registered: 2016-07-08

Posts: 23

Packages and ISO files's signature and verification

Hi,

The [c]tazpkg[/c] scripts download files from the (main) mirror and verify them using [c]md5[/c] method. This is very traditional and I think the packages can be easily modified by 3rd parties.

Is there any feature / plan to support more secure signature and verification methods? (Using GPG for example)

Thanks

hackdorte

Member

Registered: 2014-06-05

Posts: 83

Re: Packages and ISO files's signature and verification

See: /var/lib/tazpkg/packages.md5

AnhHuynh

Member

Registered: 2016-07-08

Posts: 23

Re: Packages and ISO files's signature and verification

@Hackdorte: Yes I see that file, but I don't think that is enough.