ask about Alpine Linux package manager security

[phabricator-migrator]

Information

ID: 212
PHID: PHID-TASK-iemlabltythhnzd2ulft
Author: Patrick
Status at Migration Time: wontfix
Priority at Migration Time: Normal

Description

At first sight it looks like alpine’s package manager suffers from the same issues as gentoo’s. (Being vulnerable to indefinite freeze and downgrade attacks.)

TODO:
Ask Alpine Linux mailing list about this.

Comments

---

Patrick

2015-03-08 18:51:56 UTC

The more I am considering to switch to other distributions, the more I am getting convinced, that moving away from Debian is not a good idea at this point. Debian provides so much that is difficult to get from another distribution. updated - Reasons for being based on Debian:
Security-Focused Operating System Comparison as Base for Whonix

---

ncopa

2015-06-23 12:05:46 UTC

care to give any details about indefinite freeze and downgrade attacks that gentoo has?

Why do you think apk-tools has it too?

---

Patrick

2015-06-23 14:59:55 UTC

Too long ago… Trying to find this again…

Gentoo: downgrade attacks, source:

• Gentoo Updater: Find out if it passes the TUF Threat Model · Issue #10 · Whonix/Gentoo-Port · GitHub

Might also contain some info:

• [gentoo-portage-dev] Security and Comparison of Portage with other Package Managers: [gentoo-portage-dev] Security and Comparison of Portage with other Package Managers - gentoo-portage-dev - Gentoo Mailing List Archives
• [gentoo-portage-dev] Portage and Update Security: [gentoo-portage-dev] Portage and Update Security - gentoo-portage-dev - Gentoo Mailing List Archives

You might be interested in this:

• Issues · Whonix/Gentoo-Port · GitHub

Rather, maybe also in this:

• Issues · Whonix/Gentoo-Port · GitHub

Alpine apk:

• If I remember right…
• only packages are signed
• package metadata is not signed
• package metadata does not expire (no Valid-Until field) (Valid-Until field in Release files | Ganneff’s Little Blog)