Why does APT not use HTTPS?

5 comments · 56% upvoted · source · other discussions

comments

bootbootbootbootboot

That was an interesting read, but I'm not sure this is the right subreddit for it

tobozo

why not ? Raspberry Pi uses apt after all (in degian-based OS at least)

[deleted]

it uses a thousand things, none of which is pi-specific (meaning none of them are applicable here)

[deleted]

to answer the question - because the packages themselves are digitally signed and those signatures are verified at installation time...

lamby [OP]

verified at installation time...

Actually at "apt update" time, not installation time. (But no real difference)