| 1 |
Antoni Grzymala wrote: |
| 2 |
> How about getting back to GLEP-57 [1]? Robin Hugh Johnson made an effort |
| 3 |
> a year ago to summarize the then-current state of things regarding tree |
| 4 |
> and package signing, however the matter seems to have lain idle and |
| 5 |
> untouched for more than a year since. |
| 6 |
> |
| 7 |
|
| 8 |
One concern I have with the GLEP-57 is that it is a bit hazy on some of |
| 9 |
the implementation details, and the current implementation has some |
| 10 |
weaknesses. |
| 11 |
|
| 12 |
I go ahead and sign my commits. However, when I do this I'm signing the |
| 13 |
WHOLE manifest. So, if I stabilize foo-1.23-r5 on my arch, at best I've |
| 14 |
tested that one particular version of that package works fine for me. |
| 15 |
My signature applies to ALL versions of the package even though I |
| 16 |
haven't tested those. |
| 17 |
|
| 18 |
Now, if we had an unbroken chain of custody then that wouldn't be a |
| 19 |
problem. However, repoman commit doesn't enforce this and the manifest |
| 20 |
file doesn't really contain any indication of what packages are assured |
| 21 |
to what level of confidence. |
| 22 |
|
| 23 |
If we want to sign manifests then the only way I see it actually |
| 24 |
providing real security benefits is if either: |
| 25 |
|
| 26 |
1. The distro does this in the background in some way in a secure |
| 27 |
manner (ensuring it happens 100% of the time). |
| 28 |
|
| 29 |
2. Every developer signs everything 100% of the time (make it a QA |
| 30 |
check). |
| 31 |
|
| 32 |
The instant you have a break in the signature chain you can potentially |
| 33 |
have a modification. If somebody cares enough to check signatures, then |
| 34 |
they're going to care that the signature means something. Otherwise it |
| 35 |
only protects against accidental modifications, and the hashes already |
| 36 |
provide pretty good protection against this. |
Archives