Question regarding download of templates (linux containers) and security

[SimonB]

Hi,

just asked myself, how safe/secure it is, to use the storage -> Templates -> Download function? Is the download from a trustworthy repository? is it encrypted? is the download digitaly signed to ensure, that i will not run a "manipulated"/unsecure container in my environment?

With respect to the points mentioned above, is it safe to use the storage -> Templates -> Download chain to run containers in a productive environment/network?

Thanks in advance,
Simon

 

[fabian]

The template index files (one from Proxmox, one from Turnkey Linux) are GPG-signed (and verified) and contain hashes of the template archives which are also checked (but are unfortunately still MD5). I'll see what can be done to transition this to a more reasonable hashing algorithm, and check the GPG related parts as well.

Thanks for the pointer!