Re: [gentoo-dev] 2004.1 will not include a secure portage.

[Paul de Vrieze]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tuesday 23 March 2004 13:21, Kurt Lieber wrote:
> On Tue, Mar 23, 2004 at 03:11:47AM -0800 or thereabouts, Robin H.
Johnson wrote:
> > I wrote up a functional prototype patch Mon, 8 Dec 2003 and mailed
> > it to gentoo-core when a discussion on the subject was in progress.
> > This is the ONLY code I've seen produced by anybody on the subject
> > of GPG signing to date.
>
> rac also had a proof-of-concept working.  However, as I understand it,
> the issues preventing this from becoming a reality are not technical
> in nature, but more process and policy oriented.  Quite frankly, I
> think the only issue standing between us and getting this implemented
> is having the Portage folks deem this as an important project and
> prioritize it accordingly.

Ok, the biggest problem is an idea for how the actual checking should 
function. (Signing is straightforward).

I'll take a first shot at describing a key chain idea. Please shoot at it 
and try to find the holes. But remember it needs to stay workable. First 
the premises:

- - All developers should be able to sign with their own key
- - We can register the keys of the developers before allowing them
- - We don't necessarilly (want to/can) sign the keys of all the developers
- - The system is gentoo-specific so we can implement custom systems.
- - A root key should be kept safe.

What do I propose:
- - one master key whose public key is put on every cd. It should be signed
  by as many people as possible and also put on a ssl protected website
  with a real certificate (payed for).
- - a signing key. This key is signed by the master key and is rotated on a
  regular basis (say once a month). The public key is put in the portage
  tree.
- - The signing key is used for signing a list of the fingerprints/public
  keys of all developers with ebuild commit privileges.
- - After an rsync all signatures for packages with changes are checked.
  This will first check the signing key based on the known master key
  (which should change as little as possible and be kept very secure).
  It also verifies that the signing key is not too old. This is important
  so that compromise of the signing key will be less of a security issue
  even when it is not possible to get the revokation of the key to all
  users.
  Then it will verify that the list of developer keys is valid based on
  the signing key.
  Next it will check that the signature file for this package is correct
  and validates that the key used for signing this signature is in the
  list of acceptable keys.
  If the package is found to be invalid we could start with removing the
  package from the repository.
- - As the checking is done post-rsync there is no problem with infrequent
  rsync-ing.

note:
*) alternatively there could be a key between the signing key and the
   master key, this root key could have a one month rotation. Then this
   root key could be used to have a daily generated signing key.

   The disadvantage is that the root key and signing key would be
   passphraseless to allow for automatic signing of either the signing
   key and the dev key list. (assuming that manually entering keyphrases
   daily is too much)

   *) It might be possible to keep the passphrase for the daily signing
      key in memory (or even the whole secret part, which would mean
      that changes in developer keys would only be visible with a one
      day delay (max) or manual regeneration of a signing key)

Paul

- -- 
Paul de Vrieze
Gentoo Developer
Mail: pauldv@g.o
Homepage: http://www.devrieze.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAYDetbKx5DBjWFdsRArC0AJ989ls+w+RszK7FazB0I8hq9//swQCg2BUA
sXkzItayvUSKux+/rfHFx1w=
=N+pp
-----END PGP SIGNATURE-----

--
gentoo-dev@g.o mailing list