Skip to Content.
Sympa Menu

sm-commit - Re: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (ad0a24226e43aeb1ac12e792c02e31f3011852c4)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: seth AT swoolley.homeip.net
  • To: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • Cc: sm-commit AT lists.ibiblio.org
  • Subject: Re: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (ad0a24226e43aeb1ac12e792c02e31f3011852c4)
  • Date: Sat, 12 May 2007 02:01:45 -0700

When you sign a vendor's private key, you also assert to your faith in
their security policy. It's in the PGP FAQs all 'round the web.

In any case, theoretical examples are great and all, but you need to
look at the reality. The reality is that if we include the upstream
author's key for a spell we get an immense advantage in preventing
people going 'oh that spell must have been changed and not reversioned'.

A failed signature though is _never_ explainable with simple excuses
like that. People get in the habit of ignoring bad checksums -- they
don't ignore invalid signatures.

And to completely moot your argument: If their key storage security
policy is bad, you've already got the keys to the house, and our own use
of their signature for the first version downloaded (where you get your
sacred hash) is only a little bit less suspicious. Heck, start sending
emails out in private to posters of the mailing list saying you've got a
new version out as their identity and provide a non-official url with an
official signature and you're likely to fool half the people. Once
you've got the private key for somebody, the game's over already, since
if you're able to change a primary mirror AND sign falsely, you can just
wait for the next release cycle and change the signature on the mirror
with your magic private key a few seconds after release -- then you've
COMPLETELY compromised both hashes and the PKI.

Your example is contrived and is a small islet of a complaint in a sea
of major problems with using straight hashes.

Seth

On Fri, May 11, 2007 at 09:52:35PM +0200, Ladislav Hagara wrote:
> > Then store the upstream signature for the release in the grimoire itself.
> > Is there something preventing this from happening? It's been suggested
> > many times.
>
> So why nobody do it. Let's go.
> It is not a problem only of "my" spells. It is a problem of all spells.
> So all developers should store upstream signatures in grimoire.
> All signatures of all vendor signed spells shoud be stored in grimoire.
>
> The only one spell without signature in the grimoire can destroy all SMGL
> boxes.
> Hacker/cracker just steals vendor private key (we know nothing about
> security policy of small project and we download sources and signatures
> form their sites), modifies sources - added something like "rm -rf /*" to
> "configure" and signs it.
>
> IMHO, better than adding upstream signatures to the grimoire is just add
> next level of checking of sources.
> 1st level - vendor/upstream signatures. 2th level - our own signatures or
> hashes.
>
> ---
> Building XXX
> Upstream/vendor GPG checking source file XXX.tar.bz2...
> gpg signature verified!
> SMGL GPG/HASH checking source file XXX.tar.bz2...
> FAILURE to verify gpg signature/HASH
>
> Sources XXX.tar.bz2 are signed by upstream key/developers of XXX
> but they are different from sources SMGL developers have tested.
>
> Abort? [y]
> ---
>
> --
> Ladislav Hagara
>
> _______________________________________________
> SM-Commit mailing list
> SM-Commit AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-commit




Archive powered by MHonArc 2.6.24.

Top of Page