0

Does the built-in pacman package manager in Arch-based systems require successful cryptographic authentication and integrity validation for all packages?

I know that software downloaded with apt-get packages must be cryptographically verified because the repo's manifest files (synced with apt-get update) are cryptographically signed.

But what about pacman?

Do Operating Systems with pacman require valid signatures from a pinned set of keys on all packages by default?

1 Answer 1

1

Pacman on Arch Linux enforces signature verification by default:

Package security

Pacman supports package signatures, which add an extra layer of security to the packages. The default configuration, SigLevel = Required DatabaseOptional, enables signature verification for all the packages on a global level: this can be overridden by per-repository SigLevel lines. For more details on package signing and signature verification, take a look at pacman-key.

See: https://wiki.archlinux.org/title/Pacman#Package_security

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .