Artix Linux Forum

On a couple of my machines, I strangely got GnuPG errors trying to pull packages from system-testing so I had to delete the /etc/pacman.d/gnupg directory and then repopulate all the keys. After that, it all worked fine. Just FYI in case anyone lurking encounters the same issue.

You did not read and follow the instructions correctly

UPDATE:  Yes, thank you, it did work.  Sddm runs again and the difference I believe was in the mesa-17.02-0-3/17.02-0-2 package.

We provide quality packages with nothing to hide! Joking aside, package mirrors don't really need https, the content is public.

In general, you can't trust anything on an unsecured connection on any network where a MITM could be present (ie, you don't have complete physical control and security of the routing and wiring). A Man in the Middle could monitor and alter any unsecured connection by pretending to be you to the host and pretending to be the host to you. Neither system would be aware of the presence. The file could be entirely replaced or executable could be altered or replaced to do malicious things quite easily.

There are, however, a number of ways to prevent this. Authenticated connections such as HTTPS guarantee that only two end points (at least one of which is trusted) can communicate. In brief, HTTPS works by the server having a special piece of information that the browser can validate is the server you think it is. That information can then be used to send a key generated by your client to the trusted server in a way that only the server can understand. Because the MitM doesn't know the newly shared key, the server can then respond using that key to encrypt the connection and the MitM can no longer observe or alter the meaningful contents of that communication and any alterations would cause it to appear as gibberish (or possibly be detected based on the protocol in use).

Another technique is called checksums. A checksum is a small piece of information that can be independently provided to validate a much larger file. It generally consists of a hash of the file that is being sent which can then be rehashed after receipt in order to ensure the file didn't have any errors in transmission. If the checksum and the file are obtained from different connections, it is a little more difficult for the MitM to alter both, however it could still be possible for both to be altered. The checksum could also be cryptographically signed by the file distributor to ensure the checksum can not be altered by the MitM.

The best method is to combine the two approaches and include a cryptographically signed checksum that validates that the file came from the sender while also communicating the file over a secure connection. This ensures that the data isn't corrupted during transmission and also ensures that it comes from the expected host.

Man-in-the-middle attacks allow attackers to intercept, send and receive data never meant to be for them without either outside party knowing until it is too late.

Companies and developers need to make the conscious decision to host binaries via SSL/TLS, whether or not the binaries are signed. All people, but especially those in countries hostile to “Internet freedom,” as well as those using Tor anywhere, should be wary of downloading binaries hosted in the clear.

is this right?

Code: [Select]

 # Artix mirrors
  Server = http://mirror1.artixlinux.org/artix-linux/repos/$repo/os/$arch

should it not be

Code: [Select]

Server = https://mirror1.artixlinux.org/repos/$repo/os/$arch

?

Instructions as I see them clear, because all of the above seemed very confusing.

1  edit /etc/pacman.conf and uncomment the [system-testing] and the line below it.
Not the world and galaxy testing, they are not ready yet.
2  edit /etc/pacman.d/mirrorlist and add 

Code: [Select]

Server = http://mirror1.artixlinux.org/repos/$repo/os/$arch

https is not working as of 20170912 - 12 UTC  but it may work in the near future?  For now use http
3  pacman -Syyu

We are moving away from Sourceforge hosting, main reason being the restriction of colon characters (':') in filenames, which breaks the package database with epoch-versioned packages. Our new primary mirror is active and serving. The rest of the mirrors will sync soon.

To use the new repo, you must enable [system-testing] above [system]. After updating artix-mirrorlist from [system-testing], users will need to rename /etc/pacman.d/mirrorlist.pacnew to /etc/pacman.d/mirrorlist and re-sync.

Code: [Select]

pacman -Sy system-testing/artix-mirrorlist

After that, you can comment-out [system-testing] and wait until the updates make it to [system], or be guinea pigs bold and brave testers and report any issues.