Public SourceMage Discussion List

[seth AT swoolley.homeip.net]

On Sun, May 13, 2007 at 02:51:27AM +0200, Ladislav Hagara wrote:
> > > Your example is contrived and is a small islet of a complaint in a sea
> > > of major problems with using straight hashes.
> 
> BTW, what is more suitable for data integrity, sha512 or sha1 usually
> used in upstream signatures?
> But I really don't want to remove upstream signatures, they are great,
> only insufficient.

sha512 can be used in upstream signatures, too, which is why the hash 
level is configurable in sorcery. (I haven't checked, but I hope the 
valid source hash list applies to gpg checks too.)

> 
> 
> > completely separate from the source, and there are benefits to this. Of
> > course it's true that the original source (and its hash) could have
> already
> > been compromised, but we have to start somewhere.
> 
> 
> Of course source and its upstream hash/sig could have already been
> compromised,  but our own hash/sig asserts that some of us have compiled
> this "compromised" source, installed it, tested it and our box has
> survived it. We can't identify sophisticated attack but certainly we are
> able to find out "rm -rf /*" in configure.

Good point except that it could be time-bombed.

> 
> 
> > Storing the upstream signature in the grimoire or keeping a hash as a
> > second-level check *would* guard against the possibility of the upstream
> > source and signature being compromised after the release.
> 
> 
> Not only compromised. This guarantees we all have the same sources. It
> is quite frequent that vendor improve source code and releases it with
> the old version number. With local hash/sig we can get it. It is very
> difficult to solve problems if we don't have the same source code.
> 
> As I wrote already, better than adding upstream signatures to the
> grimoire is just adding next level of checking of sources.
> 1st level - vendor/upstream signatures downloaded with sources
> 2th level - our own signatures or hashes stored in grimoire

I suggest it could be automated to fetch sources that are missing a 
hash double-check and it could be added through a git hook (of course, 
we might want to use a sha512 hash, but we should indicate that the hash 
came from a sha1 signature, if we automate it this way -- maybe 
provide the ability to list all elements in the verification chain/tree 
instead of a single verification statement).

Seth

> 
> 
> -- 
> Ladislav Hagara
> 
> 
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss