Download from apt-get through HTTPS only?

Question

Today during a sudo apt-get dist-upgrade I noticed that at the beginning of the process it lists a series of lines starting as:

Get: 1 http:/mirrordirector.raspberrypi.org ... Get: 2 http:/archive.raspberrypi.org ...

Is this the actual download ? If yes it sounds really insecure or am I wrong ? How can it be safe from a man in the middle attack for example ?

My question: how can you force that part or any other process of apt-get to use only HTTPS please ?

Thanks !

Answer 1

Do not worry about the http download of apt. The packages get verified as follows:

• The repository contains a Release file that is signed by a Release.gpg file (see http://archive.raspberrypi.org/debian/dists/jessie/)
• The signature is verified against your local apt keyring.

• The Release file contains pointers to package files including checksums.

  Example:

  a4fd2468a91ee139fe9e5d1997dba3e7fbc33c45d6897e30c2f4da179896e4be 656343 main/binary-armhf/Packages

• The package files are only accepted if the checksum is ok.

• The package files contain pointers to packages including the package checksums.

  Example:

  Package: alacarte Version: 3.11.91-2+rpi3 Architecture: all Maintainer: Debian GNOME Maintainers <[email protected]> Installed-Size: 329 Depends: python:any (>= 2.6.6-7~), gnome-menus (>= 3.5.3), python-gi (>= 3.0), gir1.2-gtk-3.0, gir1.2-gmenu-3.0 (>= 3.5.3), gir1.2-glib-2.0, gir1.2-gdkpixbuf-2.0 Priority: optional Section: utils Filename: pool/main/a/alacarte/alacarte_3.11.91-2+rpi3_all.deb Size: 110658 SHA256: 1c907e52ff7c60e6057c9a11aca48c32af8491801b254b36a8c0afb631589500 SHA1: 673c05ee1c89e9a138e75923b7ddc539bdf2b53e MD5sum: 186d519bf48108a9f987c67b27f14fd3 Description: easy GNOME menu editing tool Alacarte is an easy-to-use menu editor for GNOME that can add and edit new entries and menus. It works with the freedesktop.org menu specification and should work with any desktop environment that uses the spec.

• apt will only accept the downloaded packages if the checksum is fine.

Some additional notes:

• If you add an additional key to your local keyring then you have to make sure that you get that key from a trusted source.
• apt is clever enough to take a checksum that is strong enough (e.g. not MD5 or sha1 even though you can see such checksums in the above files.)
• The signature and checksum verification is done on the local machine after the download of the data. Therefore the system is protected against man in the middle attacks.
• If you want to install closed source packages it is of course a good idea to do the download over an encrypted channel (ssh, https, vpn) to protect the intellectual property that may be contained within the Debian packages.