In https://pagure.io/fedora-infrastructure/issue/5372 we talk about cert pinning for atomic host content. Is this something that might be possible to implement here as well? basically we would hard code into the package information about all the cert(s) that fedoraproject.org would use so it could validate that there was no MITM or other issues happening.
For which purpose you would like to use these certificates? I am asking because I am not sure whether such an approach is optimal for dnf because availability of certificates after rpm install means that they are not available during the transaction for any verification.
Yeah, I realize this is kind of a vuage request. Sorry about that. I think the idea was that we could hard code/ship in dnf itself the cert (or a fingerprint, etc) of the mirrors.fedoraproject.org cert. Then, it could check this internal thing to make sure it was talking to the real mirrors.fedoraproject.org. However, this presents various hard problems like updating the cert when we do, setups with proxies where they trust their proxy and it has a differnt cert, etc. I'm fine to just close this for now unless a advocate for it is willing to design something here.