Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:

> On Aug 29, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
> > Quoting Seth Alan Woolley <seth AT positivism.org>:
> >
> > > DRAFT, although this is one case where we're actually moving on it
> > > quickly, so it's more of a last call for objections.
> > >
> >
> > So here goes: I object.
> >
> > 1. Hash collision is not a problem when it comes to source tarballs, 
> > so please
> > don't use it as a reason to switch to signatures. We could've as 
> > easily hashed
> > them with CRC32 or with 10K-bit hash. *Either* way provides *no* security.
>
> If someone is able to modify the sources while keeping the hash intact, we
> can't detect it just checking the hash.  This is a problem.  If we're using

I would agree with you if there were an example of that. Examples of 
generating
a collision in the hash don't count because they do not produce a valid 
source.
Or, I should say, do not produce valid source yet. Chances of this 
happening are
much lower than producing a hash collision.

> signatures instead of just hashes, they have to modify the signature in
> place instead of just the hash it's based on or subvert the private key and
> re-sign.  For guru-signed spells especially the private key is going to be
> stored somewhere completely different from the upstream sources; the
> attacker changing the upstream sources isn't likely to even be aware of our
> signatures and keys.

I don't argue that GPG key is worse. It *is* better, I agree. However, I argue
that hash is *sufficient* for a long time, and GPG signature if not 
coming from
the author is excessive and misleading. If maintainers want to sign 
packages, I
don't mind, but I can't consciously do that.

> > 2. There's no way I can sign a bunch of code I didn't read through and
> > understand. It's an impossible task in a distribution, so it's 
> > shorter to say
> > that I can't sign a bunch of code, period.
>
> As we've said several times, guru signatures explicitly do not mean that
> you've read the source, they only mean that a source which passes the

Please read item #4 again. You're trying to substitute a different 
meaning for a
meaning that is already there. It may work for you, but not for me, and 
I argue
that it is not going to work for other people. People *will* be misled by GPG
signatures. More aggressive people will blame *you* as the signee. It's like
helping the police by shooting and killing their suspect: you've helped 
them in
their purpose, but at what price? Police needs help from you in identifying
suspects and informing the authorities, but not in doing your own 
justice. What
I'm saying is, you're putting too much responsibility upon yourself 
even though
you disclaim it. It your choice, but don't force me to do the same.

> signature check is the same as what you downloaded.  I don't think we can
> say this any clearer than we have, so the fact it keeps coming up means to
> me that people just don't want to hear it.  There's simply no reason a
> signature has to mean more than we tell our users it means.  It's not even

Yes there is. Signing a document means you *read* it and *agree* with it. Why
signing a tarball shouldn't mean the same.

> > 3. Let's be frank Seth, tarballs that you, or anyone else besides 
> > the authors,
> > signed are as *insecure* as they were before you did that. It didn't format
> > your hard drive? Good for you. Maybe it's designed to format only *mine*. Or
> > the drive of the guy who works for CIA ot Chinese government. You don't know
> > that.
>
> Of course they're just as insecure with the signature.  That's not the
> point.  The point is that if I sign something at point in time A, and you
> get it at point in time B and the signatures still match, then at point in
> time B it is at least *not any more insecure* than it was at point in time
> A.

Hashes are sufficient for that. I object to making signatures mandatory.

> > 4. Combination of #2 and #3 leads me to believe that we do not provide *any*
> > additional security over unsigned tarballs, so let's focus on *integrity*.
> > Integrity is *perfectly* verified by the hash. Stronger hash if 
> > necessary, but
> > nevertheless a hash. Non-personified piece of information.
>
> This is what we've been saying for quite some time.  We make no guarantees
> the source won't destroy someone's system, just that download integrity was
> preserved.  And we want to use GPG for that instead of a simple hash
> because it a) requires an attacker to expend more resources to subvert the
> integrity check, and b) lets us offload much of the check itself to people
> better equipped to handle it than we are.  The Unix way.

a) is true but it's overkill; attacker would have not only have to 
create a hash
collision, but make sure this collision has a meaning, e.g. be compileable or
executable; I'm willing to change this viewpoint if there's one 
confirmed study
that shows just such a hash collision;
b) is good for package authors, and is a perfect reason *not* to make 
signatures
mandatory.

> > 5. What people keep saying on the list amounts to: let's call it blue even
> > though it's black. Meaning, let's call GPG signature a means to verify
> > integrity even though it's a means to verify source and integrity. I 
> > don't buy
> > that.
>
> Again, there's no reason it has to mean this.  If you sign for a package
> delivered to your neighbor, does it bind you to any claims that the package
> isn't a mail bomb?  Signatures are used for all kinds of things in the real
> world and digital world.  What it means is what we say it means.

You're signing the receipt, meaning you agree that you received the package.
There's no analog that I can think of in terms of source code tarballs. 
Package
has been accepted by the carrier, inspected for controlled objects, and was
wrapped. Package has a return address that has likely been verified, and a
trail of how it got to you. There's no wrap or return address on tarballs, and
nobody inspects them.
However, see above about the analogy of signatures on documents. I think it
suits better.

In short, I object to *mandatory* GPG signatures, and I refuse to sign source
that's not mine with my name.

Sergey.