Support https source

[Ben Chow]

Proxmox VE still uses http source by default, http protocol can be easily hijacked or eavesdropped. I tried changing it to https, but Proxmox VE seems to block the use of https.
Hopefully Proxmox VE can improve this.

 

[Veidit]

Here is a translation (I just used Google Translate):

Proxmox VE still uses http sources by default, and the http protocol can be easily hijacked or eavesdropped. I tried changing it to the https protocol, but Proxmox VE seems to be blocking the use of https. Hopefully, Proxmox VE can improve this.

 

[t.lamprecht]

and the http protocol can be easily hijacked or eavesdropped.

That does not matter at all because the packages are signed and verified after download against our dedicated release key:
https://pve.proxmox.com/pve-docs/pve-admin-guide.html#repos_secure_apt

This happens independent of the transport medium, which is important as a TLS connection on its own does not give you any guarantee that the packages was actually build by us or Debian.

 

[Veidit]

That does not matter at all because the packages are signed and verified after download against our dedicated release key:
https://pve.proxmox.com/pve-docs/pve-admin-guide.html#repos_secure_apt

This happens independent of the transport medium, which is important as a TLS connection on its own does not give you any guarantee that the packages was actually build by us or Debian.

Agree, but why not supply both?

 

[Ben Chow]

That does not matter at all because the packages are signed and verified after download against our dedicated release key:
https://pve.proxmox.com/pve-docs/pve-admin-guide.html#repos_secure_apt

This happens independent of the transport medium, which is important as a TLS connection on its own does not give you any guarantee that the packages was actually build by us or Debian.

Can both be provided at the same time? Can https transmission be actively selected?

 

[t.lamprecht]

Agree, but why not supply both?

There simply is no technical benefit, but yeah some user occasionally run into this, so it might be worth to look into.

Can both be provided at the same time? Can https transmission be actively selected?

At the moment no, and even if it will not provide you any benefit. Again, the repos are secured by the GPG release key, not some TLS/SSL certificate used for http.

 

[Ben Chow]

Can allow manual modification https in subsequent versions? This will make the repo list look unified XD