Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Compromise on signatures

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] Compromise on signatures
  • Date: Tue, 30 Aug 2005 17:01:56 -0400

OK, so we'll talk about wording now?

Quoting Eric Sandall <eric AT sandall.us>:

Maybe if I show that the 'common' case of GPG verification for
distributions is what the current SMGL policy is (and that's being
argued about):

Fedora: http://fedora.redhat.com/docs/yum/sn-managing-packages.html
"Check the public key, and then press y to import the key and
authorize the key for use. If you press N or Enter , yum stops without
installing any packages.

To ensure that downloaded packages are genuine, yum verifies the
digital signature of each package against the public key of the
provider. Once all of the packages required for the transaction are
successfully downloaded and verified, yum applies them to your system."

We're not providing these packages. Users download them from Web sites. We exist
as a distribution that doesn't rely on the middleman (distributor) to ascertain
that everything is clean. If I wanted a secure distro, I'd have to stick to it
and get all my packages only from it. We're not in this business.

GnuPG FAQ: http://www.gnupg.org/(en)/documentation/faqs.html#q7.1
"GnuPG is also useful for signing things. Files that are encrypted
with the secret key can be decrypted with the public key. To sign
something, a hash is taken of the data, and then the hash is in some
form encoded with the secret key. If someone has your public key, they
can verify that it is from you and that it hasn't changed by checking
the encoded form of the hash with the public key."

It's not from me. As I told Seth, I am not the originator of the tarball, so the
file is *definitely* not from me.

GNA: https://gna.org/forum/forum.php?forum_id=731
"Signed files that could not be verified will be moved in
subdirectories named /maybe-corrupted."

GNA FAQ:
https://gna.org/faq/export_html.php?group_id=101#Download_Server_--_How_can_I_certify_or_check_the_authenticity_of_stored_files.txt
"To check the authenticity of a file, one of the best tools currently
available is GPG. We will not describe here what is GnuPG and how it
works: if you are looking for that information, check the GnuPG
documentation."

I don't think we learned anything new here.

SaMBa: http://us2.samba.org/samba/download/
"The Samba distribution GPG public key can be used to verify that
current releases have not been tampered with."

Exactly. How do I know that? I'm not a contributor to the Samba project. I'm not
reading their source code commits list. But why do you think it means "tampered
in transfer" as ooposed to just "tampered with"? The difference is in the fact
that not just any key holder can sign a Samba tarball, but a developer Samba
project trusts to do that. There's a difference.

Linux Security: http://linsec.ca/security_policy.php
"When you are installing software on your system(s), verify that it
hasn't been tampered with. Most authors provide md5sums for downloaded
source packages, and many are creating detached GPG signatures for

Authors. Not distributors.

software. Verification of software packages prevent problems like
trojaned openssh tarballs (not meaning to pick on the OpenSSH team
here, merely illustrating that critical software can be trojaned). One
should always attempt to verify distributed files via some means of
authentication. If you download RPM packages, check to make sure the
md5 and/or GPG signatures are intact. Auditing source code would be a
great thing to do, but realistically, this likely won't happen unless
you have excessive resources and/or a lot of spare time on your
hands."

Note that the integirty of the file is all that GPG is being used for,
guaranteeing that the file you downloaded is the one they meant you to
have. They are /not/ guaranteeing that the file is free from bad code,
malicious intent, etc.

Really? Only integrity? Somehow I didn't notice that. It's not written in any of
the samples above. It's not implied either.

Also note that the last one explicitly states that auditing source
code would be nice, but isn't likely nor even guaranteed.

That's the reason not to sign the stuff that's not coming from you. That's why I
proposed signing spells.

I can go look up more if you want. I don't see how you can be saying
that using GPG as we're intending, and as the above + world also uses
it, is incorrect and against whatever perceived knowledge of how GPG
is to be used that you have.

Terminology continues to be pervasive in these arguments. Feel free to comb
through a bugtraq archive to find out what hoops people have to jump through in
order to send a vulnerability report to CERT. Do you think CERT is giving them
all that trouble just to make sure the information is not altered in transit?
They'd have used SSL for that.

So, tell me the decision. I'm waiting.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page