Feature Requests
New / Open / Unreviewed
Repo "Security" status is currently misleading - more advanced logic needed?
At the moment it seems the security status of a repo is tied to whether a repo uses SSL or not. I would argue this is not accurate or is at least not fully representative of security.
I would propose more advanced logic be used to check whether a repo uses GPG signing and/or SSL, to give a better indicator.
Longer term, it may be sensible for PatchMon to also keep a record of common OSes and package manager endpoints / signing keys for which a comparison could be made indicating an incorrect, expired or rotated key / repo etc...
As an example, highlighting a particular repo is EOL or has been replaced may be within PatchMon scope e.g. Puppet vs OpenVOX
This has been brought up in the past for sure. It's something that needs looking into to make it more relevant to how package managers work.
A repo being secure is definitely something more relating to GPG keys like you said as opposed to being http or https - I agree.
It needs work.
For now i'm putting it in the Project roadmap for it to be worked on.
Thanks for highlighting this.