At first sight it looks like alpine's package manager suffers from the same issues as gentoo's. (Being vulnerable to indefinite freeze and downgrade attacks.)
TODO:
Ask Alpine Linux mailing list about this.
Description
Description
Event Timeline
Comment Actions
The more I am considering to switch to other distributions, the more I am getting convinced, that moving away from Debian is not a good idea at this point. Debian provides so much that is difficult to get from another distribution. updated - Reasons for being based on Debian:
https://www.whonix.org/wiki/Dev/Operating_System#About_Debian
Comment Actions
care to give any details about indefinite freeze and downgrade attacks that gentoo has?
Why do you think apk-tools has it too?
Comment Actions
Too long ago... Trying to find this again...
Gentoo: downgrade attacks, source:
Might also contain some info:
- [gentoo-portage-dev] Security and Comparison of Portage with other Package Managers: https://archives.gentoo.org/gentoo-portage-dev/message/bda425ee6c676ec7a6b3c9500a9b00bf
- [gentoo-portage-dev] Portage and Update Security: https://archives.gentoo.org/gentoo-portage-dev/message/94425239fcaedcee6c49ef398f12aa85
You might be interested in this:
Rather, maybe also in this:
Alpine apk:
- If I remember right...
- only packages are signed
- package metadata is not signed
- package metadata does not expire (no Valid-Until field) (http://blog.ganneff.de/blog/2008/09/23/valid-until-field-in-release-f.html)