1 |
On Monday 30 November 2009 22:18:21 Richard Freeman wrote: |
2 |
> Antoni Grzymala wrote: |
3 |
> > How about getting back to GLEP-57 [1]? Robin Hugh Johnson made an effort |
4 |
> > a year ago to summarize the then-current state of things regarding tree |
5 |
> > and package signing, however the matter seems to have lain idle and |
6 |
> > untouched for more than a year since. |
7 |
> |
8 |
> One concern I have with the GLEP-57 is that it is a bit hazy on some of |
9 |
> the implementation details, and the current implementation has some |
10 |
> weaknesses. |
11 |
> |
12 |
> I go ahead and sign my commits. However, when I do this I'm signing the |
13 |
> WHOLE manifest. So, if I stabilize foo-1.23-r5 on my arch, at best I've |
14 |
> tested that one particular version of that package works fine for me. |
15 |
> My signature applies to ALL versions of the package even though I |
16 |
> haven't tested those. |
17 |
> |
18 |
|
19 |
I may be wrong - then please correct me. You don't sign every package versions |
20 |
but Manifest. Thus you somehow prove every file checksum is correct. If there |
21 |
were any changes made on server side, those checksums would be incorrect |
22 |
according to your signed Manifest. Currently any change may be fixed by whoever |
23 |
it is by the same command ebuild foo digest. |
24 |
|
25 |
> Now, if we had an unbroken chain of custody then that wouldn't be a |
26 |
> problem. However, repoman commit doesn't enforce this and the manifest |
27 |
> file doesn't really contain any indication of what packages are assured |
28 |
> to what level of confidence. |
29 |
|
30 |
That's what should be discussed - forcing developers to sign their commits and |
31 |
implementing this support in package managers. |
32 |
|
33 |
> |
34 |
> If we want to sign manifests then the only way I see it actually |
35 |
> providing real security benefits is if either: |
36 |
> |
37 |
> 1. The distro does this in the background in some way in a secure |
38 |
> manner (ensuring it happens 100% of the time). |
39 |
> |
40 |
> 2. Every developer signs everything 100% of the time (make it a QA |
41 |
> check). |
42 |
> |
43 |
> The instant you have a break in the signature chain you can potentially |
44 |
> have a modification. If somebody cares enough to check signatures, then |
45 |
> they're going to care that the signature means something. Otherwise it |
46 |
> only protects against accidental modifications, and the hashes already |
47 |
> provide pretty good protection against this. |
48 |
> |
49 |
|
50 |
That's not really true. I see tips like "if you have digest incorrect, run |
51 |
ebuild foo.ebuild digest" very often. Really small group of people care about |
52 |
broken digests. :( |
53 |
|
54 |
-- |
55 |
Cheers |
56 |
Dawid Węgliński |