Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] changing hashes / upstream signatures (was: [SM- Commit] GIT changes to master grimoire by Ladislav Hagara (ad0a24226e43ae b1ac12e792c02e31f3011852c4))

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: seth AT swoolley.homeip.net
  • To: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] changing hashes / upstream signatures (was: [SM- Commit] GIT changes to master grimoire by Ladislav Hagara (ad0a24226e43ae b1ac12e792c02e31f3011852c4))
  • Date: Sun, 13 May 2007 21:28:00 -0700

On Sun, May 13, 2007 at 02:51:27AM +0200, Ladislav Hagara wrote:
> > > Your example is contrived and is a small islet of a complaint in a sea
> > > of major problems with using straight hashes.
>
> BTW, what is more suitable for data integrity, sha512 or sha1 usually
> used in upstream signatures?
> But I really don't want to remove upstream signatures, they are great,
> only insufficient.

sha512 can be used in upstream signatures, too, which is why the hash
level is configurable in sorcery. (I haven't checked, but I hope the
valid source hash list applies to gpg checks too.)

>
>
> > completely separate from the source, and there are benefits to this. Of
> > course it's true that the original source (and its hash) could have
> already
> > been compromised, but we have to start somewhere.
>
>
> Of course source and its upstream hash/sig could have already been
> compromised, but our own hash/sig asserts that some of us have compiled
> this "compromised" source, installed it, tested it and our box has
> survived it. We can't identify sophisticated attack but certainly we are
> able to find out "rm -rf /*" in configure.

Good point except that it could be time-bombed.

>
>
> > Storing the upstream signature in the grimoire or keeping a hash as a
> > second-level check *would* guard against the possibility of the upstream
> > source and signature being compromised after the release.
>
>
> Not only compromised. This guarantees we all have the same sources. It
> is quite frequent that vendor improve source code and releases it with
> the old version number. With local hash/sig we can get it. It is very
> difficult to solve problems if we don't have the same source code.
>
> As I wrote already, better than adding upstream signatures to the
> grimoire is just adding next level of checking of sources.
> 1st level - vendor/upstream signatures downloaded with sources
> 2th level - our own signatures or hashes stored in grimoire

I suggest it could be automated to fetch sources that are missing a
hash double-check and it could be added through a git hook (of course,
we might want to use a sha512 hash, but we should indicate that the hash
came from a sha1 signature, if we automate it this way -- maybe
provide the ability to list all elements in the verification chain/tree
instead of a single verification statement).

Seth

>
>
> --
> Ladislav Hagara
>
>
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss




Archive powered by MHonArc 2.6.24.

Top of Page