Hacker News Reader

Comment by LeonidasXIV | Hacker News Reader

It didn't used to support it not too long ago so I had to setup my server to explicitly not redirect to HTTPS for one particular location because people would need to install apt-transport-https for it.

View on HN

It's been in there for years

EDIT: Over 12 years to be precise.

  * added apt-transport-https method

Fri, 12 Jan 2007 20:48:07 +0100

it was in a secondary package for a long time though (until apt 1.5 in 2017)

So in order to get the HTTPS transport, you needed to first download the required package over HTTP.

We used FAI[1] to install it into the boot images we used and then ran it that way (other methods), but there still is the verification of the packages you put on those. Short of manually auditing the code and compiling that yourself then there's not much else in the trust chain. It's not really that necessary though, realistically, with the other protection methods. We just did it as it was fun to do and well, we could!

[1] https://fai-project.org/

Reply on news.ycombinator.com