Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Basesystem Cache files on Mirror

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: David Kowis <dkowis AT shlrm.org>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Basesystem Cache files on Mirror
  • Date: Thu, 28 Apr 2005 14:51:25 -0700

On Thu, Apr 28, 2005 at 04:23:59PM -0500, David Kowis wrote:
> Ondra Tomecka wrote:
> >
> > And don't forget that this has potential for a huge security hole, when
> > some malicious user contributes tarball with modified binary. How are we
> > supposed to detect such a thing, or prevent it at all? Not that I think
> > such tarball cache is bad idea, it would save me quite a lot of time
> > sometimes, but still this security concern is a big one.
>
> Perhaps, since there's stuff in sorcery for GPG verification, we could
> use gpg to verify the tarballs. If the QA Team is going to generate them
> then they could sign the tarballs and put the signature and the cache on
> the download site.

In the past I've had signature generation on my mirrors. It wasn't used
much in the past and we had alternative verification, so I don't have it
anymore, but I could easily add it back on since there is no alternate
verification.

Anything GPG-signed for use in a stable system requires a certain level
of caution. I'll make it not automatic, passphrased, and signed only
once when I approve the release.

Perhaps we can add a tool to import caches from one system to another by
downloading with liburl and gpg-checking them with libunpack. It could
be called "wand" -- a tool to assist magic. I could sure use such a
procedure for all my boxes in odd places. Tied with "cabal", updates
would be easy to distribute.

Seth

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id 00BA3AF3 = 8BE0 A72E A47E A92A 0737 F2FF 7A3F 6D3C 00BA 3AF3
Quality Assurance Team Leader; Security Team Member, Leader Emeritus
Linux so advanced, it may as well be magic http://www.sourcemage.org
Elected Coordinating Committee Member, Secretary, and Finances Chair
Pacific Green Party of Oregon - Peace - http://www.pacificgreens.org

Attachment: pgpiZ0zGPevfY.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page