In connection with another thread discussing the fact that Bitbucket’s closure of mercurial support had affected the availability of around 60+ projects’ published versions, I learned of a number of facts about how the opam repository is arranged, and how it is managed that are concerning. In summa…

Hello, first of all thanks for your post raising this issue, which is important for me as well. I’ve been evaluating and working on improving the security of the opam-repository over the years, including to not use curl --insecure (i.e. properly validate TLS certificates) - the WIP result is conex ,…

[image] hannes: “Authors can modify URLs and hashes” ← sometimes (when a repository is renamed or moved on GitHub) the GitHub auto-generated tarball has a different checksum. For a while now, we have avoided doing this in the opam-repository, we usually ask to reupload the tarballs from the o…

[image] hannes: I’ve been evaluating and working on improving the security of the opam-repository over the years, including to not use curl --insecure (i.e. properly validate TLS certificates) - the WIP result is conex , which aims at cryptographically signed community repositories without single…

[image] mseri: This could surely be useful, after all we are human and prone to error. It should also support making packages unavailable “available:false” Yes, that is the other edit which came to my mind as well. What I forgot to mention above is that while you can “secure” the ocaml/opam-…

The conex project looks very interesting. I need to do more reading on it and its objectives, but you were right in our private communications that its aims appear to go well beyond the specific ills I’m observing at the moment, i.e. not only ensuring artifact integrity but also guarding by construc…

[image] hannes: “Never retains ‘published’ artifacts” ← this is not true, the opam.ocaml.org host serves as an artifact cache, and is used by opam when you use the default repository. Yes, I’m aware that there is an artifact cache, but there are definitely contexts where it is not authoritat…

[image] mseri: [image] hannes: “Authors can modify URLs and hashes” ← sometimes (when a repository is renamed or moved on GitHub) the GitHub auto-generated tarball has a different checksum. The problem with any justification for why hashes and/or upstream artifacts might change is that …

[image] cemerick: As you say elsewhere, without cryptographic signatures, the provided hashes are “just” checksums. Unfortunately, md5 appears to be widely-used, and as we all know, entirely useless. Since in the current state of affairs the hashes are effectively just checksums against unint…

[image] dbuenzli: Since in the current state of affairs the hashes are effectively just checksums against unintentional data corruption it should be noted that contrary to popular belief there’s absolutely nothing weak or useless in using md5 for that. You’re quite right, I was projecting as …

Opam-repository: security and data integrity posture

Ecosystem

XVilka September 23, 2020, 5:26am 11

Closely related issue is How to setup local OPAM mirror, since the integrity checks and verification will become even more important if there will be multiple mirrors in the future.

1 Like

Topic		Replies	Views
Opam package decentralization Learning opam	17	727	February 10, 2026
OPAM Experiment and future Developer Experience improvements Community opam , build	10	2719	July 6, 2017
Serious OPAM package quality issues Community opam , user-feedback	60	7402	September 25, 2017
Introducing a "yanked" mechanism in opam Ecosystem opam , jbuilder	27	2818	April 10, 2018
Opam repository archival, phase 2 - OCaml 4.08 is the lower bound Ecosystem announce , opam-repository	21	984	February 26, 2025

Opam-repository: security and data integrity posture

Related topics