Nethserver repos do not provide signed repomd.xml files (repomd.xml.asc). and leaves users vulnerable to man in the middle attacks.
it would be nice if
It seems even upstream doesn’t fully support it:
https://bugzilla.redhat.com/show_bug.cgi?id=1360939
I also found this (old) post which explains potential problems:
Also I can’t understand how a MITM is possible: even if repomd.xml is compromised, all RPMs are GPG signed and the verification is enabled by default.
Yes, you could get a tempered metadata file, but RPMs will be the good ones.
following article explain the man-in-the-middle scenarios for package manager.
https://lwn.net/Articles/327847/
usually people use yum-fast-mirror plugin which automatically select fastest mirror (which could be compromised one)
Both RHEL-7/CentOS-7 contain repomd.xml.asc, you can check RHEL repo or any CentOS mirror.
However the EPEL repository doesn’t repomd.xml.asc. But for EPEL one can use
the official mirror https://dl.fedoraproject.org/pub/epel/7/x86_64/
Thank you for the clarification, it worth reading!
We could add the repomd.xml.asc file, but I’d rather don’t like enabling repo_gpgcheck option to avoid unexpected behavior.
What do you think @davidep and @filippo_carletti?
I would start adding the repomd.xml.asc file and then ask some expert users to enable checks (repo_gpgcheck=1).
If no problems arise, we can release an update.
B U M P
Would be nice to have this starting from NethServer 7.6
More info
It’d be nice to update the wiki as well with (current) instructions on how to do this for third-party repo maintainers. I see the four-year-old blog post, but in two major releases of RHEL/CentOS, I’d suspect things may have changed a bit.
The NethServer repositories now have the repomd.xml.asc file.
I need a solution to enable the signature check for 7.6 automatically. If that is not possible, we’ll document how to do it manually in 7.6 Release Notes.