pkgng/pkgng — Issue #151: repo signature checking can be bypassed trivially
Author: jillest
Created: 2012-02-10 18:35:27+00:00
State: open

update_from_remote_repo() in pkg/update.c only checks the signature if repo.txz contains one. If there is no signature, it appears content not to check anything.

The public key should be configurable per repository and should probably be mandatory.