AUR (en) - spideroak-one

Git Clone URL:	https://aur.archlinux.org/spideroak-one.git (read-only, click to copy)
Package Base:	spideroak-one
Description:	Secure file backup, sync and sharing client. SpiderOak One client.
Upstream URL:	https://crossclave.com/
Keywords:	backup
Licenses:	LicenseRef-SpiderOakONE
Provides:	spideroak
Submitter:	warnem2
Maintainer:	warnem2
Last Packager:	warnem2
Votes:	267
Popularity:	0.091161
First Submitted:	2015-07-18 19:17 (UTC)
Last Updated:	2025-04-20 03:51 (UTC)

Latest Comments

« First ‹ Previous 1 .. 7 8 9 10 11 12 13 14 15 16 17 .. 29 Next › Last »

nesk_aur commented on 2015-03-08 06:28 (UTC)

@cb474 They updated the key for .deb packages just 1 year ago, can you check please? https://blog.spideroak.com/20130920145427-ubuntudebian-apt-repository-gpg-key-update

cb474 commented on 2015-03-08 00:29 (UTC)

@coolpyrofreak That blog post that you link to is six years old. The GPG key in that post expired four years ago. It's even more out of date that the GPG key for the .deb files. In any case, it also does not appear in the PKGBUILD for this AUR version of of SpiderOak that the download is being verified with GPG (the sha1sum check does not accomplish the same thing). As I said, as far as I can tell, there are no GPG keys for SpiderOak anymore. I'm emailing them and waiting for a response. In the meantime, in principle, it seems there is no way to know that this install of SpiderOak has not been compromised. If it was something else, I might not be as concerned. But if one is going out of one's way to use the sort of zero knowledge encryption that SpiderOak provides, it really kind of defeats the purpose not to verify the package with GPG.

warnem2 commented on 2015-03-07 05:06 (UTC)

@cb474 - They sign the RPMs used for this PKGBUILD. Read here: https://blog.spideroak.com/20090219070000-hello-fedora

cb474 commented on 2015-03-07 02:08 (UTC)

Isn't it a problem that there are no GPG signatures for this package? SpiderOak used to provide them, at least for the .deb package, but everything about this on their website seems to be out of date now. Without GPG signatures there's no way to verify that the package downloaded from the SpiderOak site is the real package. I love SpiderOak, but it kind of undermines the point of encryption like this.