| 1 |
-----BEGIN PGP SIGNED MESSAGE----- |
| 2 |
Hash: SHA512 |
| 3 |
|
| 4 |
On 03/29/2015 06:41 PM, Sebastian Pipping wrote: |
| 5 |
> Hi! |
| 6 |
> |
| 7 |
|
| 8 |
... |
| 9 |
|
| 10 |
> |
| 11 |
> * Why do we serve Git over git:// and http:// if those are |
| 12 |
> vulnerable to man-in-the-middle attacks (before having waterproof |
| 13 |
> GPG protection for whole repositories in place)? |
| 14 |
|
| 15 |
<pedant>OpenPGP (GPG is just one implementation)</pedant>, but indeed, |
| 16 |
that is what the gentoo-keys project is about. There is experimental |
| 17 |
support for OpenPGP verification in portage already using gkeys. |
| 18 |
Currently the focus is on getting developer's keys up to GLEP63 specs, |
| 19 |
i currently see 36 good Gentoo developer keys. The scheme is also |
| 20 |
flexible enough to allow for overlays. |
| 21 |
|
| 22 |
> Especially with ebuilds run by root, we cannot afford MITM. |
| 23 |
> |
| 24 |
> |
| 25 |
> So I would like to propose that |
| 26 |
> |
| 27 |
> * support for Git access through https:// is activated, |
| 28 |
|
| 29 |
https is not a good protection against MITM when factoring in global |
| 30 |
PKIX CA setup, nor would it protect with regards to server compromise. |
| 31 |
So the only viable way to secure ebuild repositories is proper OpenPGP |
| 32 |
usage. |
| 33 |
|
| 34 |
|
| 35 |
- -- |
| 36 |
Kristian Fiskerstrand |
| 37 |
Public PGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net |
| 38 |
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3 |
| 39 |
-----BEGIN PGP SIGNATURE----- |
| 40 |
|
| 41 |
iQEcBAEBCgAGBQJVGD9LAAoJEP7VAChXwav6VmsIALlhZ1g1GXYAL/ZkP+vi1L0H |
| 42 |
MLKfYcxkMgZNwEfykmRP4DvafNPDDhWT0gvFfD+vG4zucI7liQSUnzK8SbVtzz3l |
| 43 |
o/cCELtOvjq6pMnefizwxoG0IyJmu07Tu2kUPo3Qyw1I5IqHqaqFWDB/Noe5Rvuy |
| 44 |
rbXgWqMgg6rcYxOhUHN4YQFtw1xEgWW4CS8Smri2jjSRaizgQ2sw+Iji/ej4XUyW |
| 45 |
JvWdZfGfHuzTX/uWPr7ptyi9foVvTkc9Hko2t97XS/bNZvtECRNceZBOTGgHftgD |
| 46 |
nCopTHBY42G69B+z07qctdI2AH2ozskI1+42rE2k6vJLNfFcY5loidsWDPiG3a8= |
| 47 |
=9GQH |
| 48 |
-----END PGP SIGNATURE----- |
Archives