Re: Pacman package manager - taking untrusted input

[Santiago Torres <torresariass () gmail com>]

On Tue, Apr 21, 2020 at 04:27:08PM +0000, jellicent () protonmail com wrote:
> The Pacman package manager, used by Arch Linux and its 10+ derivatives,
> introduces a critical security flaw in its current state.
> ... The database, however, is not signed.

Or
 
> The code supports database signatures, so the real issue is the distro
> infrastructure.

Pick one please.

> [1] https://wiki.archlinux.org/index.php/Pacman/Package_signing

Attachment: signature.asc
Description: