RPM Packages Explained

#1

Post by qndev » Thu, Jun 27, 2019, 1:54 PM UTC

RPM Packages Explained
fedoramagazine.org

Re: RPM Packages Explained

#2

Post by _pmf_ » Thu, Jun 27, 2019, 2:29 PM UTC

What's baffling to me is that there's support for signing,, but no support for an encryption layer. When delivering software updates for embedded devices, I need to do both, so I have to roll my own container format. This seems to also be the case with package formats like ipkg/opkg, which are targeted for the embedded use case.

Re: RPM Packages Explained

#3

Post by 0x006A » Thu, Jun 27, 2019, 2:40 PM UTC

_pmf_ wrote: post #2

What's baffling to me is that there's support for signing,, but no support for an encryption layer. When delivering software updates for embedded devices, I need to do both, so I have to roll my own container format. This seems to also be the case with package formats like ipkg/opkg, which are targeted for the embedded use case.

whats the use-case for an encryption layer?

Re: RPM Packages Explained

#4

Post by ggg2 » Thu, Jun 27, 2019, 2:56 PM UTC

it doesn't explain anything!

this is a indepth user guide, at most.

Re: RPM Packages Explained

#5

Post by ggg2 » Thu, Jun 27, 2019, 2:58 PM UTC

0x006A wrote: post #3

_pmf_ wrote: post #2

What's baffling to me is that there's support for signing,, but no support for an encryption layer. When delivering software updates for embedded devices, I need to do both, so I have to roll my own container format. This seems to also be the case with package formats like ipkg/opkg, which are targeted for the embedded use case.

whats the use-case for an encryption layer?

hiding packages you have installed from your ISP/NSA/etc.

this discussion comes up time and time again (in rpm, apt et al). the consensus is: if you need that extra feature, manually download sensitive packages via ssl or something. everyone else (with nothing to hide, heh) keeps benefiting from a global cache of unencrypted transport of (mostly) open source data.

Re: RPM Packages Explained

#6

Post by pwnna » Thu, Jun 27, 2019, 3:01 PM UTC

ggg2 wrote: post #5

0x006A wrote: post #3

Earlier quoted context omitted.

whats the use-case for an encryption layer?

hiding packages you have installed from your ISP/NSA/etc. this discussion comes up time and time again (in rpm, apt et al). the consensus is: if you need that extra feature, manually download sensitive packages via ssl or something. everyone else (with nothing to hide, heh) keeps benefiting from a global cache of unencrypted transport of (mostly) open source data.

Does that help? I thought the package size is quite revealing.

Re: RPM Packages Explained

#7

Post by BuildTheRobots » Thu, Jun 27, 2019, 3:11 PM UTC

ggg2 wrote: post #5

0x006A wrote: post #3

Earlier quoted context omitted.

whats the use-case for an encryption layer?

hiding packages you have installed from your ISP/NSA/etc. this discussion comes up time and time again (in rpm, apt et al). the consensus is: if you need that extra feature, manually download sensitive packages via ssl or something. everyone else (with nothing to hide, heh) keeps benefiting from a global cache of unencrypted transport of (mostly) open source data.

Transport security & confidentiality makes sense (though at first I was trying to work out how an encrypted yum package would work).

Yum with CentOS 6 and above does support SSL for mirror sites and a handful of global mirrors also support it (HEG being one).

I suppose there's a slight race condition (eg how do I update the CA-Certificates bundle when I need the new CA-Certificates bundle to connect to the mirror site to download the update), however I tend to agree there should be some privacy as default.

Re: RPM Packages Explained

#8

Post by ryanolsonx » Thu, Jun 27, 2019, 3:30 PM UTC

I found this very enlightening. Thank you!

Re: RPM Packages Explained

#9

Post by Leace » Thu, Jun 27, 2019, 3:48 PM UTC

This article goes into more detail of RPM: https://xyrillian.de/thoughts/posts/argh-pm.html

Re: RPM Packages Explained

#10

Post by isostatic » Thu, Jun 27, 2019, 3:49 PM UTC

pwnna wrote: post #6

ggg2 wrote: post #5

Earlier quoted context omitted.

hiding packages you have installed from your ISP/NSA/etc. this discussion comes up time and time again (in rpm, apt et al). the consensus is: if you need that extra feature, manually download sensitive packages via ssl or something. everyone else (with nothing to hide, heh) keeps benefiting from a global cache of unencrypted transport of (mostly) open source data.

Does that help? I thought the package size is quite revealing.

In some cases (although the server could presumably send some random length data headers if that's a concern), but if you download multiple packages on a single connection can it still be tracked?