[Bug 1744318] Re: changelogs.ubuntu.com should be using HTTPS

[Julian Andres Klode]

I think we'll turn on https for now, and defer GPG to a later time.
There are essentially two ways we could go for that:

(1) implement GPG verification in UpdateManager. gpg is hard to use, so
I'd expect us to mess up somewhere. Also should have rollback and
starving prevention (date/valid-until).

(2) generate an InRelease file for the meta-release files, and re-use
APT for the fetching and validation. This means we get security features
automagically.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to update-manager in Ubuntu.
https://bugs.launchpad.net/bugs/1744318

Title:
  changelogs.ubuntu.com should be using HTTPS

Status in update-manager package in Ubuntu:
  Triaged
Status in update-manager source package in Bionic:
  Triaged

Bug description:
  Although the packages listed in meta-release files on
  changelogs.ubuntu.com are signature-checked there doesn't appear to be
  any way to verify the meta-release files are valid so a man-in-the-
  middle could maliciously supply an alternate meta-release.

  meta-release files should be signed with the archive GPG key and/or
  delivered over HTTPS.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/update-manager/+bug/1744318/+subscriptions