Slashdot Mirror
Package Signing Comes To Pacman and Arch Linux
fwarren writes "One of the main complaints heard around here on why some Slashdotters don't run Arch Linux is that the packages are not signed. Fear no more: Arch Linux and Pacman now allow for package signing."
Welcome to at least 2003!
Sir, you fail hard.
It's the Linux man's Linux. I have so much love for Arch and to be honest, the lack of package signing has never been an issue. But nonetheless, a welcomed addition!
Moreover, I haven't really heard of too many people complaining about the lack of Package Signing when it comes to Arch Linux, usually it's the fact that after you install, you are pretty much presented with BASH, and that's it!
Which is surprising because SOAP is a patent free industry standard.
Non impediti ratione cogitationus.
What does Arch bring to the table?
Debian has a minimal install option, is committed to freedom, has an awesome package manager, has tons of packages available, and has multiple release tracks that allow one to stay cutting edge should one wish.
RedHat is commercially supported.
CentOS is the free version of RedHat.
SLES is commercially supported, with a deal with Microsoft to interoperate.
Ubuntu is Debian made easier.
Gentoo is for people who like to recompile software for their hardware.
I get all of the above distros. I don't run them all myself -- especially not gentoo -- but I understand why some people do.
What's the point of Arch? I poked at the website and wikipedia pages, but don't see an explanation of what it gives you over, say, a base Debian install.
Note: this is not intended as a troll. I'm curious as to what Arch brought to the table. Why was it introduced? I'm sure there's an answer, just curious what.
I'd read a lot of good things about Arch, so I decided to give it a go a few months ago. I wanted to like it, I really did, but my experience over 3 ~ 4 hours was reminiscent of installing Slackware circa 2002. I don't want to have to know how to configure every package on my system from scratch, I want them to mostly work, and then be able to tweak them. I simply don't have the time for anything else. Maybe this just means Arch isn't for me, but it seemed that the install process was going out of it's way to make things as complicated as possible, a particular example was wpa_supplicant being selected for install by default, but not wireless-tools!
Did I miss something obvious that makes the whole process a lot easier, or is Arch just "like that"?
In the spoon, there is no Soviet Russia!
Comment removed based on user account deletion
Warning. The parent post in unsigned and may have been forged.
Ezekiel 23:20
Arch is not for you. Yes, the configuration is "manual" (text-based). No, it doesn't "just work", at least not in the end-user sense. (However it does "just work" in the slackware sense, meaning that when you go to compile a program for example, you can expect that all the standard unix tools and environment will be available and working as expected. Not so with Ubuntu for example.)
Arch is more or less a bleeding-edge slackware, although the system is not based on slackware but rather designed from scratch with slackware-like simplicity in mind. Arch has the simplicity and predictability of slackware, but with a modern package manager and update process, and bleeding-edge packages to top it off.
Comment removed based on user account deletion
Comment removed based on user account deletion
I've been using Arch for years, and the constant flow of virii and rootkits that were deluging me might finally go away!
With all the recent news of linux package repositories being the main vector of all these advanced persistent threats my CPO (Chief Pentest Officer) has been telling me about, I can now breath a sigh of relief.
mov ah, 4ch
int 21h
I feel like such a fearless badman for running arch linux before the packages were signed
And I saw this news just as I finished installed and updated Arch. Used it a few years ago and decided to give it a whirl again. IMO, its a damn good distro if you're interested in learning the workings of Linux and getting it to work the way YOU want it. And being a rolling release is a big plus.
Setting up Arch Linux is not hard. The article at http://lifehacker.com/5680453/build-a-killer-customized-arch-linux-installation-and-learn-all-about-linux-in-the-process is particularly useful. I did not even need to refer to the guide. Just followed the instructions at LifeHacker and then used the Arch Wiki to configure and fine tune things from there. So yeah, I can do it. But I found a better way.
I now do my Arch setups by installing ArchBang. ArchBang is a riff on CrunchBang. As a live CD, it is Arch Linux with an OpenBox GUI, a Tint2 panel, system info shown in conky and some slick CrunchBang style GUI configuration tools for OpenBox. Now setting up an Arch Linux system takes about 15 minutes. That is all the time it takes run the installer. As part of the install you need to edit two files. In rc.conf you set your hostname. In pacman.d/mirrorlist, you need to move the mirrors in your country to the top of the file. That is it.
After 15 minutes of work, you have a completely working Arch Linux system with sound, X and a Window Manager with font smoothing all set up for you.
In addition to pacman they also include packer. Which is able to install all the standard packages that pacman does but is also able to perform installs from AUR using the same syntax as pacman.
Arch + Openbox + Packer = ArchBang
vi +
Dude, don't feed the goddamned trolls! Especially since that lame pun is way too old to even start to begin to attempt to try to be funny.
Free Martian Whores!
Comment removed based on user account deletion
I notice you didn't mention slackware -- that explains why you don't get it. Arch is more or less a bleeding-edge slackware with automated package management. Now what's the appeal of slackware? In two words, simplicity and vanilla-ism. Arch and slackware are the ONLY two distributions that will give you simplicity and vanilla-ism.
With that said, I prefer slackware for servers, and arch for desktops.
Comment removed based on user account deletion
I've tried maybe 15-20 distributions in the past 15 years, and finally settled on Arch. I like it for its minimalist base installation that lets ME choose the desktop environment without installing a bunch of crap I don't need; I also like its granularity that installs ONLY the packages I choose and their dependencies without a lot of additional crap I don't need.
So, you might say, use Linux From Scratch or Gentoo instead. I did! I used LFS for five years, but once I had learned enough from it in terms of what's going on under the hood, I got tired of always having to tweak compiler flags and build 800 dependencies in exactly the right order any time I wanted to upgrade. Likewise with Gentoo, I don't think I was ever even able to get a build environment it liked.
Arch is exactly the right balance. Somebody else went to the trouble of working out all the dependences and compile flag tweaks needed to build the binaries; I just have to download the binaries and I'm done. But I still have that fine control over exactly *what* packages get installed. When my desktop environment is a simple bare Fluxbox, I don't need the whole Gnome enchilada with gadgets and widgets and applets and I don't know what all else.
vanilla doesn't suit everyone. I've used Fedora, Debian, Ubuntu and Arch (and several of their derivatives) full-time. From that experience I've learned two things:
* Arch is my favourite distro.
* My life is better when I use Ubuntu full time.
Arch has a simpler init, a better config structure, a better filesystem layout, a simpler packaging format that's easy to create build scripts for and amazingly good documentation. Also, all the points people make about AUR are valid, its marvellous. Much to love there. And that would be enough to outweigh the initial time investment of a day or two to get the system up and running how I want. But the vanilla packages are what kills the experience for me.
That's sort-of a sad realisation to come to, but it is a practical reality for many. It's not that I don't have the skills to maintain an Arch system well (I used to do sysadmin for Debian and CentOS systems), it's just that I don't have the time. Nowadays, I genuinely appreciate the Debian packaging philosophy where the package maintainers go out of their way to make sure the package is compatible and well-integrated with the rest of the distribution. With Arch, installing a new package also often requires me to spend half an hour or so configuring it or figuring out some little compatibility issue with another application. The pain is ongoing.
Rolling release doesn't help me either. I used to think it was a great idea. "Never need to reinstall again!", not like Ubuntu where I tend to reinstall every 6 months when there's a new release. However, in practice the releases give packagers some idea of the environment they are creating packages for and actually result in less time spent tinkering with the system.
Arch is a magnificent vision for what a distro could be, but it is geared a little too strongly to hobby purposes for my needs. I have work to do. Maybe Slackware would fill in the niche I've been describing, but it seems to be even less up-to-date than Debian stable.
Censorship is the opposite of education. If neo-darwinism were defensible, people would not need to try and censor ID.
The ultimate Linux distro for the semi-poweruser. Its more bleeding edge then Fedora, more solid/stable then Ubuntu (not Debian level, no sir, but close enough for desktop use), with AUR - giant software repositories (stuff Fedora didn't hear of, one click away... or command) and last, but not least, best community anywhere.
But be prepared to to spend your free weekend to set it, and polish, it up as it pretty much requires you to fit everything by hand, and then trim it to your liking.
I thought most people had realized by now that signing packages is far from being a useful security feature, unless you have some way of revoking the signature on a package-by-package basis. What you want is a signature on the repo (preferably with an expiry date, so a malicious mirror can't just keep a vulnerable repo state around forever).
A package signature protects against trojans, but gives false credibility to official packages with vulnerabilities. A hostile mirror (possibly using a MITM attack) can simply keep a vulnerable package around indefinitely. A repo signature means that the vulnerable version of the package is tied to every other package in the repo, and the only way to keep the package around is to not update any packages, which is a whole lot more obvious than not updating just one package. See Attacks on Package Managers for details.
Basically, a repo signature offers all the security of a package signature and then some. If you want any sort of package security, you need repo signatures, and if you have repo signatures, package signatures offer no extra benefit.
Gee willikers!! Looks like you need some SOAP in your mouth!
Que someone telling me not to feed the angry bear (which isn't feeding the troll who trolled another troll)... This is only gonna make him more angry isn't it.
Which is surprising because SOAP is a patent free industry standard.
Yes, but being public domain does not make it truly 'Free', therefore Stallman refuses to use it.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
I use Arch for dedicated MAME boxes.
Lean, Clean, Fast and Up to date kernels.
Pacman is easy enough to use, And the Wiki is just brilliant.
(I'm a long time Redhat/Ubuntu user - And very impressed with Arch Linux)
There's not a single Pacman-the-game/Ms Pacman joke here.
To have a right to do a thing is not at all the same as to be right in doing it