fink/fink — Issue #16: selfupdate using SSL
Author: mroi
Created: 2011-11-28 20:22:54+00:00
State: open

The package description files are currently updated via 'fink selfupdate' using either CVS or rsync. Both mechanisms send unencrypted traffic that is not protected against tampering. An attacker in a privileged network position (read: man in the middle) can alter package description files while in transit and thereby install malware into your system as you compile and install a package from the malicious description.

A proposed solution is to pull fink selfupdates via git using an SSL-protected connection.