Hacker News Reader

How are packages authenticated? I did an evaluation a couple of months ago but decided to drop it when I saw that packages where being pulled over plain HTTP and seemingly no authentication was being preformed.

For software build systems - my use case - this type of security lapse is a deal breaker.

View on HN

I don't know about msys2, but pacman supports gpg signatures, so all they would need to do (and perhaps have done already) would be to configure it for master keys.

The initial download that includes the master public keys ought to be done over https, of coures.

Yep. MSYS2 uses pacman's support for GPG signatures. The links to the installers on the website don't use HTTPS, but it looks like they've added checksums of the installers to the website itself, which is served over HTTPS.

For what it's worth, pacman does support GPG signature verification, HTTPS, and SHA-256 checksums. There is a GitHub user right now making a bunch of pull requests to MSYS2 to make our PKGBUILD scripts more secure, mostly by using HTTPS and SHA-256 whenever possible.

Reply on news.ycombinator.com