| 1 |
On Mon, Nov 30, 2009 at 04:18:21PM -0500, Richard Freeman wrote: |
| 2 |
> Antoni Grzymala wrote: |
| 3 |
> >How about getting back to GLEP-57 [1]? Robin Hugh Johnson made an effort |
| 4 |
> >a year ago to summarize the then-current state of things regarding tree |
| 5 |
> >and package signing, however the matter seems to have lain idle and |
| 6 |
> >untouched for more than a year since. |
| 7 |
> One concern I have with the GLEP-57 is that it is a bit hazy on some |
| 8 |
> of the implementation details, and the current implementation has |
| 9 |
> some weaknesses. |
| 10 |
GLEP57 is purely informational. |
| 11 |
|
| 12 |
The GLEP on Individual developer signing has not made it into a Draft |
| 13 |
yet. |
| 14 |
|
| 15 |
But you can view the very brief version here: |
| 16 |
http://sources.gentoo.org/viewcvs.py/gentoo/users/robbat2/tree-signing-gleps/02-developer-process-security?view=markup |
| 17 |
|
| 18 |
> I go ahead and sign my commits. However, when I do this I'm signing |
| 19 |
> the WHOLE manifest. So, if I stabilize foo-1.23-r5 on my arch, at |
| 20 |
> best I've tested that one particular version of that package works |
| 21 |
> fine for me. My signature applies to ALL versions of the package |
| 22 |
> even though I haven't tested those. |
| 23 |
This was covered in the draft linked above. |
| 24 |
A larger discussion on it is welcome, as while both competing options |
| 25 |
exist, neither has a clear advantage over the other. |
| 26 |
|
| 27 |
> Now, if we had an unbroken chain of custody then that wouldn't be a |
| 28 |
> problem. However, repoman commit doesn't enforce this and the |
| 29 |
> manifest file doesn't really contain any indication of what packages |
| 30 |
> are assured to what level of confidence. |
| 31 |
Chain of custody from infrastructure to user is covered in GLEP58 |
| 32 |
(MetaManifest). |
| 33 |
|
| 34 |
> If we want to sign manifests then the only way I see it actually |
| 35 |
> providing real security benefits is if either: |
| 36 |
> |
| 37 |
> 1. The distro does this in the background in some way in a secure |
| 38 |
> manner (ensuring it happens 100% of the time). |
| 39 |
See GLEP58. |
| 40 |
|
| 41 |
> 2. Every developer signs everything 100% of the time (make it a QA |
| 42 |
> check). |
| 43 |
+1 on this. |
| 44 |
|
| 45 |
> The instant you have a break in the signature chain you can |
| 46 |
> potentially have a modification. If somebody cares enough to check |
| 47 |
> signatures, then they're going to care that the signature means |
| 48 |
> something. Otherwise it only protects against accidental |
| 49 |
> modifications, and the hashes already provide pretty good protection |
| 50 |
> against this. |
| 51 |
GLEP60 covers the Manifest2 filetypes and better logic on which |
| 52 |
missing/mismatches should be considered as fatal. |
| 53 |
|
| 54 |
-- |
| 55 |
Robin Hugh Johnson |
| 56 |
Gentoo Linux: Developer, Trustee & Infrastructure Lead |
| 57 |
E-Mail : robbat2@g.o |
| 58 |
GnuPG FP : 11AC BA4F 4778 E3F6 E4ED F38E B27B 944E 3488 4E85 |
Archives