0001062: No secured download available for kali linux package repositories

ID	Project	Category	View Status	Date Submitted	Last Update

0001062	Kali Linux	General Bug	public	2014-02-26 13:17	2025-07-14 09:17

Reporter	KALIMERO	Assigned To	rhertzog
Priority	normal	Severity	major	Reproducibility	always
Status	closed	Resolution	won't fix
Platform	x64	OS	Kali	OS Version	1.0
Product Version	1.0.6

Summary	0001062: No secured download available for kali linux package repositories
Description	I can not find any secured download for kali linux packages. https://http.kali.org does not exist. I feel like I do not have to explain on a place like this why secured access to packages of a distro like kali is mandatory.
Steps To Reproduce	apt-get update
Additional Information	This in combination with the archive-key not being available via https is an open invitation to any third party that can control (parts of) your network to inject manipulated packages into every kali distro. A professional security linux distro should offer https access to packages.

rhertzog 2014-02-26 13:28 administrator ~0001571	https doesn't provide any supplementary security. Release files are signed with the archive key, checksums of Packages and Sources file are in the Release file, checksums of .deb are in Packages files. Thus there is a trust chain from Kali to each individual file that you can download from the mirror. I agree that the archive key ought to be provided on some https:// location for the case where you don't have it already... but that's the exception since you normally have it in the live ISO that you downloaded and for the live ISO you should have checked the public checksums that Kali releases.

Date Modified	Username	Field	Change
2014-02-26 13:17	KALIMERO	New Issue
2014-02-26 13:28	rhertzog	Note Added: 0001571
2014-02-26 13:28	rhertzog	Status	new => closed
2014-02-26 13:28	rhertzog	Assigned To	=> rhertzog
2014-02-26 13:28	rhertzog	Resolution	open => won't fix
2025-07-14 09:17	g0tmi1k	Priority	urgent => normal