Changes between Version 202 and Version 203 of FAQ

Timestamp:

Jan 9, 2026, 6:33:34 PM (2 weeks ago)

Author:

jmroot (Joshua Root)

Comment:

rephrase security section

FAQ

@@ -356 +356 @@
 See [wiki:FAQ/GitHubMigration GitHubMigration].
 
-== Information security and the integrity of the MacPorts base sofware and individual packages ==
-
-=== What controls are in place to check that the MacPorts utility is not tainted with malicious contributions and that the port scripts are not installing other than what it says on a Portfile? ===
+== Information security and the integrity of the MacPorts base sofware and individual packages == #security
+
+=== What measures are in place to ensure that MacPorts is not tainted with malicious contributions and that the port scripts are not installing other than what it says on a Portfile? === #integrity
 
 For the integrity of the base software:
-* the MacPorts.dmg installer is signed by one of the project members, so that ensures the integrity of the initial installation.
+* the MacPorts .pkg installer is signed by one of the project members, so that ensures the integrity of the initial installation.
 * the selfupdate process also uses signed tarballs that are checked against a public key that is part of the installation.
 
@@ -369 +369 @@
 For the integrity of the ports tree:
 * the distributed ports tree is also signed and the signature is verified when syncing the Portfiles.
-* the Portfiles itself come from the GitHub git repository, so the whole ports tree can be identified by a commit hash.
-
-It's not impossible that a committer could "turn evil" (though that would probably be noticed), or that software could be packaged that was compromised upstream.
+* the Portfiles come from the GitHub git repository, so the whole ports tree can be identified by a commit hash.
+
+It's not impossible that a committer could begin acting maliciously (though that would probably be noticed), or that software could be packaged that was compromised upstream.
 
 For the integrity of the Portfiles:
 * that relies on what is merged into the ports tree, which are developed on GitHub with Pull Requests and reviews by project members.
 * the Portfiles also contain checksums to verify the upstream sources used for building the software.
-* all downloaded have to be the same for all users (also a requirement in order to mirror these distfiles correctly).
-
-The base code, ports tree, and most upstream software has source readily available, so definitely do your own audit of all of that before using it for anything critical.
-
-=== How to verify the integrity of a MacPorts installation? ===
-
-You could in principle compare existing installation of the base software to a signed tar ball.
-Currently, there is no ready existing tooling for that.
+* all downloaded files have to be the same for all users (also a requirement in order to mirror these distfiles correctly).
+
+The base code, ports tree, and most upstream software has source readily available, so it would be possible and advisable to audit all components before using them for anything critical.
+
+=== How can the integrity of a MacPorts installation be verified? === #verifyinstall
+
+You could in principle compare an existing installation of the software to a signed tarball.
+Currently, there is no tooling for that.
 Also, some ports will be built locally, so there won't be a single "canonical" signed tarball for everything available.
 
-=== What does MacPorts in capabilities for auditing of installation? ===
-
-Being open source, MacPorts is inherently more auditable than proprietary binaries, but the drawback is you have to assume responsibility yourself.
+=== What capabilities does MacPorts offer for auditing of installations? === #auditing
+
+Being open source, MacPorts is inherently more auditable than proprietary binaries, but the drawback is the responsibility for this falls on the user.
 The MacPorts project is not in a position to make any guarantees and has to disclaim all liability.
-As far as integrity of the local files, we're mainly just relying on filesystem permissions.
-A third party file integrity checker should work fine though.
+Integrity of MacPorts files on disk relies on appropriate filesystem permissions. By default, files are owned by root and cannot be modified by other users.
+If you wish to check whether files have been modified since installation, a number of third party file integrity checkers are available and should work well with MacPorts.