Re: [gentoo-dev] Gentoo & package security

[Jean-Michel Smith]

On Friday 11 October 2002 04:53 pm, Christian Skarby wrote:

> Well, if one have such a strategy how can one be absolutely sure people
> authoriezed to modify packages have pure intentions? At some level one
> just will have to relay on something / others. It is not possible or at
> least not effective to reinvent wheels every day.

Short of meeting someone at a GPG key exchange party, there is no way to be 
certain.  But there are lots of ways to be "reasonably certain."

> On this mailinglist we've had discussions about pgp-signed ebuilds. Then
> atleast one can trace security-issues back to spesific signatures and make
> sure that the source is from whom it claims to be. But secure
> authentification is not easy to set up and not between people not knowing
> eachother in person.

I think we (by "we" I mean the free software community in general, although in 
this context, the Gentoo community specifically) are making the mistake of 
looking for perfection (a good thing) and not being willing to impliment a 
GPG signature appraoch at all if we can't achieve it (a bad thing).  As I've 
said before, distributing keys or keychains of public keys for a core circle 
of developers that people can be reasonably certain of isn't difficult, while 
absolute, 100% perfect certainty is extraordinarilly difficult (requiring in 
person, face to face meetings, etc.)

Someone suggested selling CDs with optimized binaries as a possible revinue 
stream for the Gentoo project.  Such a CD would hold no interest to me ... 
even at work I do stage-1 installs, then compile the rest on each macine 
indivually so that it is completely optimized for that machine, against 
whatever versions of libraries and software happen to be present at that 
time.

However, I WOULD pay for a CD containing a certified keychain of public keys 
for key Gentoo developers, against which I could check GPG signatures of 
ebuilds and source tarballs.  That would IMHO be invaluable, especially if 
such were combined with a peer to peer (e.g. FreeNet) alternative to ebuild 
and tarball downloads.

But, in order to achieve 'reasonable certainty' said public keys could be made 
available from multiple, independent public key servers, as well as web sites 
(c.f kernel.org), ftp download sites THAT ARE NOT THE SAME sites one gets 
portage and the source tarballs from, and so on.

Multiple conduits, from which people can download multiple copies of the keys 
or keyrings in question, whcih can then be checked against one another.  So 
long as they all agree, all is okay.  If one or more disagree, that should 
raise a red flag.

Being able to buy a copy on CD, that is then mailed snailmail, provides an 
additional level of assurance.

Absolute certainty?  No.  
Good enough?  You bet, and vastly better than what we have now.

my 2 cents, and worth every penny :-)

Jean.