0

Does the built-in pacman package manager in Arch-based systems require successful cryptographic authentication and integrity validation for all packages?

I know that software downloaded with apt-get packages must be cryptographically verified because the repo's manifest files (synced with apt-get update) are cryptographically signed.

But what about pacman?

Do Operating Systems with pacman require valid signatures from a pinned set of keys on all packages by default?

Michael Altfield
  • 826
  • 4
  • 19

1 Answers1

1

Pacman on Arch Linux enforces signature verification by default:

Package security

Pacman supports package signatures, which add an extra layer of security to the packages. The default configuration, SigLevel = Required DatabaseOptional, enables signature verification for all the packages on a global level: this can be overridden by per-repository SigLevel lines. For more details on package signing and signature verification, take a look at pacman-key.

See: https://wiki.archlinux.org/title/Pacman#Package_security

user264282
  • 11
  • 1