Why doesn't HTTPS to a package mirror prove the packages that mirror serves are untampered?

## Two different guarantees It is worth stating both precisely, because conflating them is the classic error in this area. **Transport security (TLS)** gives you: the endpoint presented a certificate for the name you asked for and proved possession of the corresponding private key; and the bytes exchanged with that endpoint were not read or modified by anyone in between. Its scope begins at your process and ends at the server socket. **Artifact integrity (a publisher signature over the package, verified by the consumer)** gives you: these exact bytes were produced by the holder of a key you already decided to trust, wherever they travelled and however many hands they passed through. Its scope begins at the publisher and ends at the consumer. A mirror sits *inside* the first scope and *outside* the second. That is the whole answer: TLS terminates at the mirror, so the mirror is not a man in the middle - it is one of the two ends. Everything it serves is served over a genuine, valid connection. ## The trusted-because-it-is-local mirror Consider an internal update mirror on a factory network, serving operating-system packages to the controllers and line-side devices that run a physical process. The devices are configured to fetch from it - often *only* from it, because the plant has no general internet egress. The mirror was set up for availability and bandwidth, and it inherited trust from the fact that it is on the local network behind the plant firewall. Now give an attacker a position on that network, or on the mirror host itself: a contractor's laptop, an unpatched jump host, a technician with legitimate access to the mirror's storage. They do not need to defeat TLS, forge a certificate or intercept anything. They replace a package on the mirror. Every device that updates from it installs the modified package during the next maintenance window. The assets here are not customer records. They are the **safety and availability of a physical process**: a controller that behaves differently under load, an interlock that responds late, a line that stops during a shift. This is worth naming because a defender who only ever pictures data theft under-rates the mirror as a target. ## What actually holds The defence is that the client verifies a signature made by the publisher, using a trust anchor it did not receive from the mirror. Three consequences follow, and each is a place real deployments go wrong: 1. **The trust anchor must not come from the mirror.** If devices are provisioned to trust a key that the mirror serves, or if the mirror is allowed to re-sign packages with its own key, the end-to-end property is gone and you are back to trusting the mirror. Re-signing at the mirror is convenient and it is exactly what removes the guarantee. 2. **Verification must actually be enforced.** A client configured to accept unsigned packages, or to warn and continue, gains nothing from the fact that signatures exist upstream. Signing that is never verified changes nothing. 3. **A signature answers authorship, not everything.** It says the publisher produced these bytes. It does not say the package is free of vulnerabilities, and it does not by itself make the mirror an honest narrator of what exists - a mirror still decides which packages a device is ever offered, so a plant that stops seeing updates at all deserves an alert as much as one that sees a bad one. ## Where the same reasoning applies The pattern generalises to any intermediary in the distribution path that terminates the connection and holds a copy: a caching edge in front of a download site, a shared internal artifact host, a vendor's regional distribution point. In each case the intermediary is a *legitimate endpoint*, which is why channel security cannot see its dishonesty, and in each case the countermeasure is the same shape - integrity that is created by the publisher, carried with the artifact, and checked by the consumer. ## How to answer this in an interview Say the two guarantees, in one sentence each. Say that the mirror is an endpoint rather than a man in the middle, which is why TLS is satisfied. Then give the countermeasure end-to-end, and add the trap: if the mirror re-signs, or if clients are configured to trust keys the mirror provides, you have moved the trust rather than removed it. Finishing with a concrete setting - devices on a plant network that trust a local host by configuration - shows you understand that the attacker position, not the protocol, is what makes this real.