[gentoo-security] Re: Is anybody else worried about this? (was: Trojan for Gentoo, part 2)

[Peter Simons]

Marc Ballarin writes:

 > If a distributor promises package integrity through
 > signatures, they are lying.

The signature doesn't promise that the package is "correct"
in any sense of the word, but it guarantees that it is the
same package Gentoo intended to distribute.

If you don't see how that improves security, then I frankly
don't know what else to say.


 > This might work for glibc (Don't know, really.). But it
 > certainly won't work for many other packages.

Again, this problem is not about glibc, it is about making
sure that data is distributed unmodified. I trust the Gentoo
developers to take care that the software they package up is
as secure as it can be. But I don't trust the Internet to
give me the same package that the Gentoo developers uploaded
to the main server.


 > My point being: Manipulations can be subtle

Manipulations are impossible if the package is signed.


 > If you use signatures to verify a package, you have to
 > understand exactly what guarantees are given.

I do.


 > The package or ebuild is identical to the version the
 > Gentoo developer signed, provided that his workstation
 > has not been compromised.

 > Nothing else is guaranteed.

Then let's guarantee that and work from there, because
without that guarantee every other security measure is
pointless.

Peter


--
gentoo-security@g.o mailing list