Security (signed packages)

Technical Issues
1

Hi all,
Having been using Mabox for a number of years, I recently again came across this:

Can you please explain why it is not a security issue to not sign the packages?

1 Like
2

Hi @slim and welcome to the forum :slight_smile:

I don’t consider this a real security issue. (However, delivering signed packages is on my TODO list)
Two reasons:

  1. There is currently only one person creating packages for the Mabox Linux repository - that person is me
  2. There is only one server delivering packages from the Mabox Linux repo. That server is under my full control. There are no mirrors in the world that are controlled by someone outside.

I understand that this may raise some concerns for some users. You are the second person to bring this up in 8 years.

Mabox is a hobby project, developed after hours in my free time. That time is never enough to implement all the ideas, features and tasks - and there are a lot of them - I think it would be enough for a full-time job.
When I find time to develop Mabox, I always prefer to work on something more exciting and fun for me.

Does this answer satisfy you? Or should I focus on delivering signed packages quickly?

1 Like
3

Thanks for the quick answer.
Unfortunately I am not so much a security expert as I would like, and I cannot assess the risks. I fully understand your considerations, and during those eight years (yes I followed you when you started the project) I didn’t mind much. But with the hysterically escalating hybrid warfare all over the planet I start to consider what could happen. You control the server is reassuring, I don’t know if a man-in-the-middle attack would be possible, say if someone targets a specific person of interest that uses Mabox?
So, right now I’m happy it’s on your todo-list, and I am staying for the moment as a quite happy user, thank you for the big effort.

1 Like
4

@slim, Packages are signed now.
Today iso refresh (250113) have SigLevel = PackageRequired option set by default.

1 Like
5

Yeah, I noticed, congratulations you were so quick :slight_smile:
However after a few updates now I get this for all the ca. seven new packages:

error: filesystem: signature from "Daniel Napora <danieln@maboxlinux.org>" is unknown trust
:: File /var/cache/pacman/pkg/filesystem-2025.01.12-1-any.pkg.tar.zst is corrupted (invalid or corrupted package (PGP signature)).
Do you want to delete it? [Y/n]

Sorry I don’t get how to properly format the error

6

You need to install mabox-keyring first.
And populate keyring:

sudo pacman-key --populate mabox
7

Yes, I put
siglevel = Optional Trustall

while that first one installed, then it works, perfect, thank you

8

I joined this forum solely to thank you for this post as it solved my updating problem which has caused me no end of issues as a newcomer to Linux. I had (prior to seeing this) tried numerous on line solutions by Arch users etc which didn’t work. So again many thanks.