Conex: deploying end-to-end trust for opam-repository
2021-01-01At the moment, the opam-repository consists of metadata (opam package files) and links to source code tarballs (checksums included). From a security perspective this is rather weak, especially since in the default setup the opam package metadata (including checksums) and tarballs are downloaded from the same server (https://opam.ocaml.org).
Over the last years, opam was extended with validation hooks (see https://opam.ocaml.org/doc/Manual.html#configfield-repository-validation-command), which is executed after a repository update. Based on its return value, opam will apply the repository update or not. Also, conex (https://github.com/hannesm/conex) was developed which checks cryptographic signatures (its design is based on https://theupdateframework.io/).
Based on our previous work (since 2016), we received a grant in 2021 from the OCaml software foundation and in 2025 from ahrefs to improve and finish our work on conex.
Involved is Hannes.