Mint mirrors update/ update reports

Questions about the project and the distribution - obviously no support questions here please
Post Reply
kdlm
Level 1
Level 1
Posts: 29
Joined: Mon Sep 28, 2015 3:37 pm

Mint mirrors update/ update reports

Post by kdlm » Wed Sep 30, 2015 2:14 pm

I just installed a mint mirrors update, priority 1. Afterwards I thought that could be a clever way to take over someone's computer if it made your updates go to the wrong server. That's probably paranoia but I'd like a confirmation that it was a legitimate update and to know if there is a place where such things can be checked.

User avatar
karlchen
Level 20
Level 20
Posts: 11310
Joined: Sat Dec 31, 2011 7:21 am
Location: Germany

Re: Mint mirrors update/ update reports

Post by karlchen » Wed Sep 30, 2015 2:54 pm

Hello, kdlm.

Assuming that Linux Mint Update Manager brought the mint-mirrors update to you, it should be genuine. Just checked on packages.linuxmint.com. The current version of mint-mirrors is v1.1.3. So in case your mint-mirrors version is 1.1.3 as well, it will be the genuine version.

You might like to launch a terminal window, run the following commandlines and post their complete screen output here for inspection:
  • Mint version and list of configured software repositories:

    Code: Select all

    inxi -Sr
    (capital S, lowercase r)
  • Which Mint Mirrors have been installed and where from:

    Code: Select all

    apt-cache policy mint-mirrors
Cheers,
Karl
Image
Linux Mint 19.2 32-bit xfce Desktop, Total Commander 9.22a 32-bit
Haß gleicht einer Krankheit, dem Miserere, wo man vorne herausgibt, was eigentlich hinten wegsollte. (Goethe)

User avatar
Crewp
Level 9
Level 9
Posts: 2517
Joined: Sat Dec 01, 2012 8:36 pm
Location: Connecticut,USA

Re: Mint mirrors update/ update reports

Post by Crewp » Wed Sep 30, 2015 4:03 pm

kdlm wrote:I just installed a mint mirrors update, priority 1. Afterwards I thought that could be a clever way to take over someone's computer if it made your updates go to the wrong server. That's probably paranoia but I'd like a confirmation that it was a legitimate update and to know if there is a place where such things can be checked.

Yes, it is a legit update.
Image

User avatar
killerbees19
Level 1
Level 1
Posts: 3
Joined: Tue Sep 21, 2010 4:33 pm
Location: Vienna (Austria)
Contact:

Re: Mint mirrors update/ update reports

Post by killerbees19 » Fri Oct 02, 2015 11:09 am

kdlm wrote:Afterwards I thought that could be a clever way to take over someone's computer if it made your updates go to the wrong server.
All packages have a digital signature which is whitelisted in your local package manager. Nobody can modify packages without having the private key(s) from Linux Mint. Sure, someone could, but it would throw out a big warning/confirmation message!

Even the mirror operators (like me) couldn't change package contents without attracting users attention. That's the security model behind APT.
Regards,
Christian

» Operator of the Froonix Mirror for Linux Mint.
» Debian/Xubuntu User – currently without Mint!

kdlm
Level 1
Level 1
Posts: 29
Joined: Mon Sep 28, 2015 3:37 pm

Re: Mint mirrors update/ update reports

Post by kdlm » Sat Oct 03, 2015 2:37 pm

I though I might be a bit paranoid. Thanks for confirmation and explanation of security protocols.

Post Reply

Return to “Non-technical Questions”