i was update from dom0 and installing some template, fedora-33-minimal for instance
i have see an error 404 before the update an noticed there the dowload was from
this mirror.linux.pizza/qubes…
i have stopped and changed connection , checked this mirror i can’t find qubes subdirectoty on it , however maybe i’m just paranoic and is a legit one
there a mirorring public list for qubes ?
i was enabled the qubes-repo-contrib and i was removed
and 2 error appear on start of update one for the bpp to sqlite and one for pgp
I think your question rests on a misconception about how things work. There is not really any such thing as a “legitimate” mirror. Any random internet stranger can set up a mirror, tell us about it, and we will add it to the mirror list.
“But couldn’t the mirror operator be malicious?!”
Yes, of course. In fact, we assume they are. That’s why Qubes places zero trust in mirrors and instead verifies the digital signatures on all packages received from them.
2 Likes
thanks for the clarification. I’m learning how things work !
1 Like