On 2021-11-19 06:57, Yifei Zhan wrote:
On 21/11/19 06:26AM, Fabio Martins wrote:
Sorry if it is a bit off-topic.
After reading an article about rogue CA's:
https://www.theregister.com/2021/11/19/web_trust_certificates/
I wonder if there is any advantage of using certificate pinning in the
process of pkg_add / sysupgrade / pkg_* while updating OpenBSD
packages.
OpenBSD does not use PKI/web of trust for integrity validation, thus I
don't think certificate pinning makes sense for those operations.
Instead, OpenBSD uses signify(1) with pubkeys in /etc/signify/ for that
purpose.
Well said. I believe it would only improve confidentiality, as rogue
middleware appliances would not be able to inspect the content of
package updates.
