Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] verifying gpg keys

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] verifying gpg keys
  • Date: Wed, 10 Aug 2005 09:37:16 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 10 Aug 2005, Jeremy Blosser (emrys) wrote:
Now that more gurus are converting spells to use gpg checking, I want to
suggest that we develop some kind of standards around the verification
expectations before we include a vendor key or sign a spell with a guru
key. Right now it's just up to the gurus, but given the variance in
familiarity with gpg concepts, I think it's important we provide some
guidance so we're actually protecting our users with these schemes.

The big advantage of vendor-provided keys and signatures is that updating
the spell to a new upstream version just means changing the version number,
there's no per-version signature or hash update/verification. The downside
of this is that if we just accept a key from the upstream server without
verifying it, and that key was itself compromised, we may have it for
multiple versions before realizing it. Given that the vendor keys often
are found on the same upstream server the source comes from, this is a real
risk. When we provide an upstream key in the grimoire we are representing
to users that we trust that key to be an authenticator that a source
tarball is not compromised.

I'm not suggesting we need to verify driver's licenses or passports or
anything. But I think we should at least try to verify the key fingerprint
from a few disparate sources/channels. We discussed this a bit on IRC and
noted that usually you can at least get it from a web site and the
keyserver, and hopefully you can find some mailing lists posts or archives
that also list it. This isn't a ton of effort, especially since you only
have to do it once for each key.

Thoughts on this? What kind of minimum should we try to establish? I'm
going through right now converting a lot of the gnu software to gpg
checking, since they provide sigs for all their current software;
unfortunately those keys aren't very widespread and it's proving difficult
to get external validation for them, so this is also a pragmatic question.
I'll probably try mailing the authors for verification if nothing else, I
guess.

I'd say that vendor-provided signatures should be verified with at
least three of the following methods:

1. Signature provided on the site
2. Signature from their official mailing lists
3. Signature verified via e-mail/mail/phone by a developer of said
project
4. Signature from keyservers (we usually use pgp.mit.edu)

Guru-signed spells are harder. We still have to verify the source per
release, but we probably should make sure people are doing more
verification here than they were probably doing with md5 sums. Just
downloading the source and running md5sum or immediately signing whatever
you get is not "verification"; all you're doing is providing verification
to users that the (possibly compromised) source they're downloading is the
same as the (possibly compromised) source the guru got when they updated
the spell. However, I don't know how per-release verification might work
for upstream vendors that don't care to provide something like sigs
already.

This would technically be implausible withour current staff. We don't
have the resources to audit every release (nor do most other distros)
for compromises. Perhaps, as a minimum, we can 'require' that gurus
download, install, and sign tarballs only from the main site (if one
is available) and not mirrors? That should limit the possible damage
by only using tarballs that the author (supposedly) put up and not
from a mirror where the author (presumably) has no control.

- -sandalle

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFC+i0/HXt9dKjv3WERAnvwAJ9QdSM+EtOdc6kkTn05xqldzIZSQwCeKQsg
9iZ8KW7aUj0BqZUTGMILIQc=
=ssNM
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page