And APT was the one being very reluctant about using HTTPS because "we sign out stuff so don't need encryption".
I think this demonstrates exactly why everything should be https.
I think this demonstrates exactly why everything should be https.
A compromised mirror cannot serve packages that aren't properly signed.
This attack used an HTTP redirect to serve a backdoored package after the signature has been verified. I'm not sure that HTTP redirect attack would work with an HTTPS repository!?