Re: [gentoo-dev] RE: Portage package security model...

[Bruce A. Locke]

On Sun, 2002-02-17 at 22:56, Nils Ohlmeier wrote:

> Maybe the developers are more busy with other things, but its never to early
> to think about security.

If this matter is important to you then please feel free to work on
adding such functionality to portage.  I would like to see a prototype
of said system. :)

Just a tip though: any such system should be easy to use for the
developer and end user, and happen pretty much automatically for
developers.  I'm personally not going to be very friendly towards any
system that requires me to do gnupg commands manually and worry about
keys every time I want to check in a package, etc.  And only the most
paranoid users are going to go through the trouble of manually verifying
each package (meaning it wouldn't be used by most users).

It may sound lazy but considering upstream packages are not signed, most
developers don't even know each other in real life, and you are
implicitly trusting anyone who has the key and cvs access (any true
paranoid would see what I'm talking about).  Unless the system is simple
and transparent for developers and end users its (disclaimer: in my view
and my view alone) a pain that gives people a false sense of security
about software they are downloading from the internet.

There is also the issue of keys... who holds them, etc.  The signing of
packages could create political side effects and formalities.  We have
quite a few developers with CVS access.  This means we are going to be
sharing keys on multiple machines or have to go through a pain in the
arse every time we want to check a package in.  

Such a system may force the solid formation of "teams" and encourage a
more unfriendly BSD-style core development model.  As a gentoo developer
I like being able to work many different aspects of gentoo whenever I
feel like it.  And if a find an annoying bug I wish to fix, I like being
able to fix it, rather then spending time asking whichever "team" is in
charge of said package and having to ask for permission or whatever.
(ok, I'm exagurating, but I've heard too many horror stories from the
history of the *BSDs)

If we decide to avoid a team based structure, then we are going to have
to worry about individual keys.  Most packages, although sometimes
marked as having a maintainer, do not really have maintainers set in
stone.  Most of the packages are freely modified by any developer who
has a real reason to make changes to said packages.  Although there are
exceptions, portage does have maintainers due to its importance and the
fact its a gentoo creation (we are the upstream maintainers).  Also if
you as a developer are aware that someone is working on a package or has
a pet project, its considered good etiquite to ask them first (chances
are they are already working on the issue anyways).  So that means we
would either have to assign maintainers with keys to specific packages
and have changes cleared through them, or have the system check every
possible key against the package to see if the package has a valid
signature from 1 of 30 or so developers (I'm guessing about that
number).

Another alternative is a global key.  One key shared among all
developers... IMHO, there isn't much point of signing after that... if
the key is leaked (accounts hacked, etc) we'd have to get in touch with
all developers, reissue keys, and resign all packages after verifying
them all.

Just my two cents on the issue, feel free to flame or just call me
paranoid, crazy, etc ;)  Personally, I liked the open (more carefree?)
attitude towards the beginning of the project and I'd hate to see that
go away because of its increased popularity :)

-- 

Bruce A. Locke
blocke@××××××.org

"Those that would give up a necessary freedom for temporary 
  safety deserve neither freedom nor safety."
   -- Ben Franklin