Let's talk about security
-
Does anyone know where I can find a UBports security roadmap?
For example, when people download something (like images) there isn't a way to check the integrity of the software. Is there any plan to implement checksums?
Or asking in a more general way, what's the plan to keep UBports phone secure?
-
We actually inherited a lot of image verification from Canonical by setting up system-image.
You can read about the GPG validation chain here: https://wiki.ubuntu.com/ImageBasedUpgrades/GPG
-
@UniSuperBox, thank you for the reply.
Yes, I know about the GPG validation chain, and I'm confident about the communication phone-server and vice versa for the official issues, so to speak.
I'm more interested in how to check integrity when downloading one of these images [0] directly, or in the security check of all those apps people are developing and uploading to the openstore, and things like that [1]. That's why I asked about the plan to keep UBports secure.
[0] http://cdimage.ubports.com/devices/
[1] Some people already tried to sneak malicious apps into the "old" Ubuntu Store.
https://insights.ubuntu.com/2015/10/15/update-on-ubuntu-phone-security-issue/
