Should packages be served on HTTPS instead of HTTP?

[franciscod]

Currently, accessing https://apt.termux.com gives a certificate error and also doesn't correctly serve the packages as in http://apt.termux.com.

Additionally:

• the bootstrap-$ARCH.zip package including the base filesystem and essential binaries is downloaded via HTTP on termux-app (see here)
• the apt package has its repo set to HTTP (see here)

What do you guys think? HTTPS is a good idea for me, but maybe there's additional security that I'm not aware of.

[fornwall]

Yes, especially the bootstrap zip should be served over https (later on apt-installed packages have their gpg signatures checked which prevents tampering). Leaving this open to fix soon.

[franciscod]

Happy to hear that :)

[fornwall]

In version 0.23 of the Termux app (being released later today or tomorrow) there has been a switch to https for the bootstrap package.

Apt-fetched packages are still using http, to avoid depending on the additional apt-transport-https package and enable caching proxies. This may be changed in the future, but I think we are secure for now since the initial (now securely fetched) bootstrap zip contains a GPG key which apt uses to validate the integrity of fetched packages before installing.

[franciscod]

Great news!

On Sun, 27 Dec 2015 04:25 Fredrik Fornwall notifications@github.com wrote:

In version 0.23 of the Termux app (being released later today or tomorrow)
there has been a switch to https for the bootstrap package.

Apt-fetched packages are still using http, to avoid depending on the
additional apt-transport-https package and enable caching proxies. This
may be changed in the future, but I think we are secure for now since the
initial (now securely fetched) bootstrap zip contains a GPG key which apt
uses to validate the integrity of fetched packages before installing.

—
Reply to this email directly or view it on GitHub
#89 (comment)
.