Public SourceMage Discussion List

[Ladislav Hagara <ladislav.hagara AT unob.cz>]

Hi,

I several times mentioned I have a problem with gpg checking of source
tarballs of small projects. If sources are signed by some gpg key it
doesn't mean we have to trust it imediately. We don't know the authors
personally, we don't know how they care about theirs keys. If attacker
gain developers private key, he is able to edit and sign for example
configure with "rm -rf /*" and we aren't able to detect it.

Another problem is that even well known projects time to time update
their sources without new version release. With our own signatures or
sha512 we are able to detect the sources were changed. With only vendor
gpg checking we are not able to detect it. For example I have two
different openssh-5.9p1.tar.gz tarbals with correct signatures.

# ls -l 1/openssh-5.9p1.tar* 2/openssh-5.9p1.tar.gz*
-rw-r--r-- 1 root root 1109995 Sep  6 07:36 1/openssh-5.9p1.tar.gz
-rw-r--r-- 1 root root     188 Sep  6 07:36 1/openssh-5.9p1.tar.gz.asc
-rw-r--r-- 1 root root 1110014 Sep  7 07:39 2/openssh-5.9p1.tar.gz
-rw-r--r-- 1 root root     188 Sep  7 07:39 2/openssh-5.9p1.tar.gz.asc

Do you have fixed openssh installed?

I suggest we add second checking for vendor gpg checking, vendor
signature with our own signature or sha512. Of course we can also
download vendor gpg signature and commit it into grimoire with
version++. If remote source tarballs is changed the checking with local
signature fails.

Time and will to "fix" this?

-- 
Ladislav Hagara