Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 30 Aug 2005, Sergey A. Lipnevich wrote:
> Quoting Seth Alan Woolley <seth AT positivism.org>:
<snip>
> > We're NOT doing that kind of validation.  Redhat signs their binaries
> > and srpms -- are they attesting to the security?  Nope, just
>
> Maybe. Can you prove otherwise? Where is the policy they use?
<snip>

Maybe if I show that the 'common' case of GPG verification for
distributions is what the current SMGL policy is (and that's being
argued about):

Fedora: http://fedora.redhat.com/docs/yum/sn-managing-packages.html
"Check the public key, and then press y to import the key and
authorize the key for use. If you press N or Enter , yum stops without
installing any packages.

To ensure that downloaded packages are genuine, yum verifies the
digital signature of each package against the public key of the
provider. Once all of the packages required for the transaction are
successfully downloaded and verified, yum applies them to your system."

GnuPG FAQ: http://www.gnupg.org/(en)/documentation/faqs.html#q7.1
"GnuPG is also useful for signing things. Files that are encrypted
with the secret key can be decrypted with the public key. To sign
something, a hash is taken of the data, and then the hash is in some
form encoded with the secret key. If someone has your public key, they
can verify that it is from you and that it hasn't changed by checking
the encoded form of the hash with the public key."

GNA: https://gna.org/forum/forum.php?forum_id=731
"Signed files that could not be verified will be moved in
subdirectories named /maybe-corrupted."

GNA FAQ:
https://gna.org/faq/export_html.php?group_id=101#Download_Server_--_How_can_I_certify_or_check_the_authenticity_of_stored_files.txt
"To check the authenticity of a file, one of the best tools currently
available is GPG. We will not describe here what is GnuPG and how it
works: if you are looking for that information, check the GnuPG
documentation."

SaMBa: http://us2.samba.org/samba/download/
"The Samba distribution GPG public key can be used to verify that
current releases have not been tampered with."

Linux Security: http://linsec.ca/security_policy.php
"When you are installing software on your system(s), verify that it
hasn't been tampered with. Most authors provide md5sums for downloaded
source packages, and many are creating detached GPG signatures for
software. Verification of software packages prevent problems like
trojaned openssh tarballs (not meaning to pick on the OpenSSH team
here, merely illustrating that critical software can be trojaned). One
should always attempt to verify distributed files via some means of
authentication. If you download RPM packages, check to make sure the
md5 and/or GPG signatures are intact. Auditing source code would be a
great thing to do, but realistically, this likely won't happen unless
you have excessive resources and/or a lot of spare time on your
hands."

Note that the integirty of the file is all that GPG is being used for,
guaranteeing that the file you downloaded is the one they meant you to
have. They are /not/ guaranteeing that the file is free from bad code,
malicious intent, etc.

Also note that the last one explicitly states that auditing source
code would be nice, but isn't likely nor even guaranteed.

I can go look up more if you want. I don't see how you can be saying
that using GPG as we're intending, and as the above + world also uses
it, is incorrect and against whatever perceived knowledge of how GPG
is to be used that you have.

- -sandalle

- --
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us                  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDFLrvHXt9dKjv3WERAuixAJoCRwuqXLb5ywcZu+EXZL14z2DI0gCfWH5y
iKD1o5nVg/mARERImV+mnMQ=
=DLmQ
-----END PGP SIGNATURE-----