Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Thu, Apr 28, 2005 at 04:23:59PM -0500, David Kowis wrote:
> Ondra Tomecka wrote:
> > 
> > And don't forget that this has potential for a huge security hole, when 
> > some malicious user contributes tarball with modified binary. How are we 
> > supposed to detect such a thing, or prevent it at all? Not that I think 
> > such tarball cache is bad idea, it would save me quite a lot of time 
> > sometimes, but still this security concern is a big one.
> 
> Perhaps, since there's stuff in sorcery for GPG verification, we could
> use gpg to verify the tarballs. If the QA Team is going to generate them
> then they could sign the tarballs and put the signature and the cache on
> the download site.

In the past I've had signature generation on my mirrors.  It wasn't used 
much in the past and we had alternative verification, so I don't have it 
anymore, but I could easily add it back on since there is no alternate 
verification.

Anything GPG-signed for use in a stable system requires a certain level 
of caution.  I'll make it not automatic, passphrased, and signed only 
once when I approve the release.

Perhaps we can add a tool to import caches from one system to another by 
downloading with liburl and gpg-checking them with libunpack.  It could 
be called "wand" -- a tool to assist magic.  I could sure use such a 
procedure for all my boxes in odd places.  Tied with "cabal", updates 
would be easy to distribute.

Seth

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id 00BA3AF3 = 8BE0 A72E A47E A92A 0737  F2FF 7A3F 6D3C 00BA 3AF3
Quality Assurance Team Leader; Security Team Member, Leader Emeritus
Linux so advanced, it may as well be magic http://www.sourcemage.org
Elected Coordinating Committee Member, Secretary, and Finances Chair
Pacific Green Party of Oregon - Peace - http://www.pacificgreens.org

Attachment: pgpiZ0zGPevfY.pgp
Description: PGP signature