Skip to Content.
Sympa Menu

sm-discuss - [SM-Discuss] gnupg signatures on website available now for sorcery and grimoires. Plus draft text of gpg source validation for grimoires.

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: [SM-Discuss] gnupg signatures on website available now for sorcery and grimoires. Plus draft text of gpg source validation for grimoires.
  • Date: Thu, 23 Dec 2004 00:03:07 -0800

test, games, and z-rejected automatically sign on the server

stable grimoire is not automatically signed, to do that, run :
~/scripts/getcodex.sh stable

It will download from tony and ask for a passphrase. This means stable
grimoire isn't updating automatically from now on. See below if you
need to get access to stable grimoire.

devel sorcery is also signed automatically. test and stable sorcery are
not signed automatically. If they are signed, they will ask for a
passphrase. I'll let Andrew know the passhrases separately. He can
sign those when he needs to. This should allow us to get more mirrors
up as well. Everybody who needs access to stable grimoire, please send
me an encrypted message (at least clear signed) with your ssh public key
if you can't login already, and I'll check your security clearance with
tony and arwed, encrypt-mail you back the passphrase, send instructions,
and confirm that you can log into the server.

I'm inserting a spell called sorcery-pubkeys that you can cast for
access to all the public keys for the keypairs we will be using to sign
all our grimoires and stuff. This spell and gnupg will be added to
sorcery basesystem soon along with actual checking code. By putting the
keys into this spell we can handle revocation and key updates gracefully
and outside of sorcery. (This installs into /etc/sorcery/local/ .)

That's it on the sorcery angle. I just need to add the checking to
"scribe" and "sorcery".

* * *

Now for the grimoire angle (i.e. source signatures for "cast").

I also plan on moving the grimoire over to using gpg instead of md5 for
source validation, using vendors first and then gurus second (that way
we can eliminate all md5s and make spell updates easier if vendors
actually sign their stuff). All section gurus will have to add their
gpg public key to their section in devel, test, and stable grimoires
(more on exactly how to do this in a wiki file I'll put up later, but
the plan is to put a keyring with your key in it named your_name.gpg).
All general gurus will have to add their gpg public key to the grimoire
roots as well. This makes key revocation easy and still compatible with
the new tablet feature of sorcery. Vendor keys can simply be added to
individual spells, a section (the big desktop environment sections, for
example), or even a grimoire.

In the first run of the conversion, I will sign everything myself so
gurus don't have to go back and sign everything in their section or any
spell they touched. We will leave md5s in for old sorceries to still
work, at first. After we've made the switch over, we'll wait a month or
two, and then remove all references to MD5[x] in every DETAILS file.
gaze checkmd5s will also be renamed and modified to do gpg signature
checks instead. This essentially means we'll be using ascii-armored
detached-signatures for everything instead of md5, with the signature
placed in a local file in $SPELL_DIRECTORY/$SOURCE.asc or one that can
be downloaded (as in the case of a vendor like kernel.org). Since the
case of the grimoire is more complicated, we'll take it a bit slower at
first. The case of sorcery is a bit more straightforward, and the one
I'm concentrating on first. Note that the signatures will always be on
the compressed form of the file if it is compressed. Doing it on the
uncompressed code is a security risk and one that we should have changed
a while ago (as demonstrated by the recent "file" command
vulnerability). This means FUZZ downloading as a feature will of course
no longer be supported -- I think we removed that a while ago anyways.

Basically, we'll be using SOURCEn_GPG_SIG and SOURCEn_GPG_KEY where n is
blank or 2 or more instead of MD5[n-1]. The key points to the public
key file relative to the spell (cascading up to the grimoire root if the
file can't be found), and the sig points to the detached signature,
relative to the spell as well, usually in the form of
SOURE2_GPG_SIG=$SOURCE2.asc . Vendor-downloaded sigs will be in the
form of:

SOURCE=blah
SOURCE2=blah.asc
SOURCE_URL=http://blah.com/$SOURCE
SOURCE2_URL=http://blah.com/$SOURCE2
SOURCE_GPG_SIG=$SOURCE_CACHE/$SOURCE2
SOURCE_GPG_KEY=blah.gpg
SOURCE2_GPG_SIG=SIGNORE

If SOURCEn_GPG_SIG=SIGNORE, it means it is a signature and should be
ignored. If it is IGNORE, it means to check the download integrity
check variables for whether or not to prompt/fail. In either case,
SOURCEn_GPG_KEY is unneeded.

In a guru-signed spell, it would look like the much simpler:

SOURCE=blah
SOURCE_GPG_SIG=$SPELL_DIRECTORY/$SOURCE.asc
SOURCE_GPG_KEY=swoolley.gpg

You would simply:
gpg --armor --detach-signature $SOURCE_CACHE/$SOURCE &&
cp $SOURCE_CACHE/$SOURCE.asc $SPELL_DIRECTORY/$SOURCE.asc
to do the signing; note how it's not on the uncompressed tarball!

And to make the *.gpg files:
gpg --no-default-keyring --keyring ./your_name.gpg --import
then paste in your public key and hit ctrl-d.
The ./ is important otherwise it goes into ~/.gnupg/ automatically.

Seth

P.S. Anybody who wants to argue with the implementation plan should
provide a fix as well. :) i.e. fixes are welcome. I hope all of that
made sense.

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: pgpssudTdqFmo.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page