Public SourceMage Discussion List

[Ladislav Hagara <ladislav.hagara AT unob.cz>]

> > Your example is contrived and is a small islet of a complaint in a sea
> > of major problems with using straight hashes.

BTW, what is more suitable for data integrity, sha512 or sha1 usually
used in upstream signatures?
But I really don't want to remove upstream signatures, they are great,
only insufficient.


> completely separate from the source, and there are benefits to this. Of
> course it's true that the original source (and its hash) could have
already
> been compromised, but we have to start somewhere.


Of course source and its upstream hash/sig could have already been
compromised,  but our own hash/sig asserts that some of us have compiled
this "compromised" source, installed it, tested it and our box has
survived it. We can't identify sophisticated attack but certainly we are
able to find out "rm -rf /*" in configure.


> Storing the upstream signature in the grimoire or keeping a hash as a
> second-level check *would* guard against the possibility of the upstream
> source and signature being compromised after the release.


Not only compromised. This guarantees we all have the same sources. It
is quite frequent that vendor improve source code and releases it with
the old version number. With local hash/sig we can get it. It is very
difficult to solve problems if we don't have the same source code.

As I wrote already, better than adding upstream signatures to the
grimoire is just adding next level of checking of sources.
1st level - vendor/upstream signatures downloaded with sources
2th level - our own signatures or hashes stored in grimoire


-- 
Ladislav Hagara