Comments (2)
There are a couple of things going on here.
First Apt and Nala are handling these the same. If we ignore the 404 errors from Nala and just look at the window, you can see it is ignoring most of the things it's trying to hit except for Packages
, just like apt is. The difference is that Nala is throwing errors with more information than apt and saying that it cannot reach those places it wants too.
I did a little digging and this repo from containerlab is kind of wild tbh. They do not use InRelease/Release file like basically every other repository, for example my repo https://deb.volian.org/volian/dists/scar/InRelease
The only accessible page from them is https://apt.fury.io/netdevops/Packages. They do have the package hashsums and stuff in there, but this isn't the most secure way to distribute packages. If you look at a Debian/Ubuntu InRelease, or even mine, they are PGP signed, and you have to have the corresponding public key on the system for apt/nala to trust them, or do as they've asked you to do by saying [trusted=yes]
. They are putting all their security into the https basket, which I do not agree with.
In this configuration if someone were to DNS hijack this domain, they could redirect it to a server with malicious .debs and apt would upgrade your systems to malicious packages with no questions asked. (Of course they have to solve the https certificate issue, which if they could compromise their DNS account to hijack the domain that wouldn't be difficult to do with letsencrypt).
With the way that most repositories work, since they are PGP signed, they would also need that private key in order to accomplish this, so it's more unlikely, and apt would give you a warning saying that the repo is not trusted.
Security ranting aside, apt and nala are working the same in this case, just Nala is giving more info. I don't know that I personally would want to hide messages like this.
from nala.
Thank you for your detailed answer.
On occasion, I will rise the issue with the weird apt repository to the Containerlab developers.
from nala.
Related Issues (20)
- incomplete upgrade HOT 1
- If uninstaller has interactive prompt, nala waits for input but doesn't show it HOT 1
- `InvalidURL`: Invalid non-printable ASCII character in URL HOT 2
- feature request for nala fetch HOT 1
- feature request nala should download pkgs with aria2 HOT 1
- Arm64 not available from Repo anymore HOT 1
- Nala on debian troff error on autocomplete HOT 3
- Feature request HOT 1
- Issues running nala after instalation. HOT 1
- man page not displaying HOT 3
- Nala Python Error On Use after Installation HOT 4
- weak algorithm in `sudo nala update` for `grub-customizer` HOT 2
- Nala hangs downloadinv expressvpn updates
- my bad
- Nala can't resolve dependencies from file glob, refuses to install LibreOffice from disk HOT 1
- Nala should accept 'y' (as well as 'j') in German Locale HOT 1
- What I would like to see in nala? HOT 1
- --reinstall Option not Working with nala HOT 1
- problem with nala install firefox
- Updated: Icons
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from nala.