Re: [gentoo-dev] Redux: 2004.1 will not include a secure portage.

[Jesse Nelson]

* Eivind Tagseth (eivindt-gentoo@××××××××.no) wrote:
> Date: Thu, 25 Mar 2004 10:08:20 +0100
> From: Eivind Tagseth <eivindt-gentoo@××××××××.no>
> To: Gentoo Developers <gentoo-dev@l.g.o>
> User-Agent: Mutt/1.5.6i
> X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.63
> Subject: Re: [gentoo-dev] Redux: 2004.1 will not include a secure portage.
>
> * John Nilsson <john@×××××××.nu> [2004-03-25 09:24:37 +0100]:
> > If a patch is signed, with a good signature, does that mean that the
> > signers has audited the patch for security holes?
> >
> > What is to say that the source compiled with an ebuild is not
> > compromised?
>
> These are the two situations that worry _me_ the most:
>
> 	1.  A package source code is compromised at the main distribution
> 	    site (or one of it's mirrors).
>
> 	    This has happened in the past and if I remember correctly,
> 	    Gentoo linux was able to discover at least one such trojan.
> 	    The source code had been tampered with, but fortunately, the
> 	    ebuild digest of that package was able to notice that.  This
> 	    was pure luck, since if the ebuild developer had made his
> 	    digest _after_ the source code had been compromised, we'd all
> 	    be running trojans today (well, maybe).
>
> 	    Having the ebuild developer _sign_ the digest wouldn't help
> 	    at all.  If the original author of the source code had a source
> 	    code signature, then if gentoo had a mechanism to verify that,
> 	    then it would have helped.
>

	Code review is only way to stop this most of the time. The other side of it is that many projects provide gpg sigs of the source. one could incorporate that as well into the distribution. Which would catch and post signing mods. Again not gonna detect anything thats gotten in there during that projects dev cycle. 

	Aside from every piece of code going through review i think you gotta just accept this risk and make a system that can easly invalidate any package that may be discovered after the fact, and incorporates the security thats provided by the author (usually a gpg sig).


> 	2.  An gentoo rsync mirror is compromised.
>
> 	    There are loads of mirrors, and no way to know how secure each
> 	    of them are.  A compromised mirror may cause a lot of damage.
> 	    If all ebuilds were signed, then such a security breach wouldn't
> 	    be much of a threat.

yup esp with 1+N sigs etc.  (/me beats dead horse)


>
> Eivind
>
>
>
> --
> gentoo-dev@g.o mailing list
>
>

--
gentoo-dev@g.o mailing list