Linux distrubtion with https repositories?

cliffordh · 03-10-2011, 03:11 PM

Is there a Linux distrubution that utilizes https based repositories?

acid_kewpie · 03-10-2011, 03:16 PM

I'd assume that most do, I just tried using fedora's default mirrors over https and they're there. I'm certainly wondering why you'd care about this at all... clearly there's nothing sensitive in any way here.

jrtayloriv · 03-10-2011, 03:18 PM

@acid_kewpie -- You would want to use https because it prevents the attacker from knowing precise versions of packages you're using and prevents man-in-the-middle attacks, where they can serve you up fake (malicious) packages.

See this, for example.

cliffordh · 03-10-2011, 03:20 PM

@jrtayloriv, yes and I don't want to have to add special exclusions in my hardware filter.

I've tried Scientific Linux and Ubuntu, both seem to only have http & ftp repository links.

I know RedHat Enterprise Linux works but the annual subsciption costs are too high.