Re: [gentoo-dev] Trustless Infrastructure

[Kristian Fiskerstrand]

On 07/02/2018 10:16 PM, Michał Górny wrote:
> W dniu pon, 02.07.2018 o godzinie 17∶36 +0200, użytkownik Jason A.
> Donenfeld napisał:
>> Hey guys,
>>
>> While our infrastructure team has some nice technical competence, the
>> recent disaster and ongoing embarrassing aftermath has made ever more
>> urgent the need to have end-to-end signatures between developers and
>> users. While the infrastructure team seems fairly impressive at
>> deploying services and keeping the house running smoothly, I'd rather
>> we don't place additional burden on them to do everything they're
>> doing securely. Specifically, I'd like to ensure that 100% of Gentoo's
>> infrastructure can be hacked, yet not backdoor a single witting user
>> of the portage tree. Right now, as it stands, rsync distributes
>> signatures to users that are derived from some
>> infrastructure-controlled keys, not from the developers themselves.
>>
>> Proposal:
>> - Sign every file in the portage tree so that it has a corresponding
>> .asc. Repoman will need support for this.
>> - Ensure the naming scheme of portage files is sufficiently strict, so
>> that renaming or re-parenting signed files doesn't result in RCE. [*]
>> - Distribute said .asc files with rsync per usual.
>>
>
> Another problem: how do you prevent attacks based on removing files?
> For example, let's say a MITM that removes new version of some packages
> and related GLSAs in order to force the user to stay at vulnerable
> version.
>

right, just to point out, this is already covered in the metamanifest
signing scheme, but wouldn't be in a separate file signing mechanism.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3