Public SourceMage Discussion List

[flux <flux AT sourcemage.org>]

Ladislav Hagara (ladislav.hagara AT unob.cz) wrote [11.10.13 10:29]:
> Hi,
> 
> I several times mentioned I have a problem with gpg checking of source
> tarballs of small projects. If sources are signed by some gpg key it
> doesn't mean we have to trust it imediately. We don't know the authors
> personally, we don't know how they care about theirs keys. If attacker
> gain developers private key, he is able to edit and sign for example
> configure with "rm -rf /*" and we aren't able to detect it.
> 
> Another problem is that even well known projects time to time update
> their sources without new version release. With our own signatures or
> sha512 we are able to detect the sources were changed. With only vendor
> gpg checking we are not able to detect it. For example I have two
> different openssh-5.9p1.tar.gz tarbals with correct signatures.
> 
> # ls -l 1/openssh-5.9p1.tar* 2/openssh-5.9p1.tar.gz*
> -rw-r--r-- 1 root root 1109995 Sep  6 07:36 1/openssh-5.9p1.tar.gz
> -rw-r--r-- 1 root root     188 Sep  6 07:36 1/openssh-5.9p1.tar.gz.asc
> -rw-r--r-- 1 root root 1110014 Sep  7 07:39 2/openssh-5.9p1.tar.gz
> -rw-r--r-- 1 root root     188 Sep  7 07:39 2/openssh-5.9p1.tar.gz.asc
> 
> Do you have fixed openssh installed?
> 
> I suggest we add second checking for vendor gpg checking, vendor
> signature with our own signature or sha512. Of course we can also
> download vendor gpg signature and commit it into grimoire with
> version++. If remote source tarballs is changed the checking with local
> signature fails.
> 
> Time and will to "fix" this?

This is a good idea. I'll simply add that I think security checking
should be different from hashing in general (i.e., in all cases).
Hashing is to make sure that content is the same. Security checking is
to make sure that content is correct (free from backdoors, etc.). Often
the two coincide, but not by definition. This means that even SMGL gpg
keys cannot be trusted for ensuring that a given tarball is the "same"
as another, and even when we have a locally signed spell source we
should still have a hash of it. Thus, I'd opt for having hashes always
required and having signatures as partially-optional, in the sense that
if there is no upstream or local signature it's left out (or given a
dummy value like WORKS_FOR_ME or whatever), but if there is a signature
available then it must be added. Sure this is more work for spell
updaters, but it's also more correct, as shown by the problem Ladislav
is pointing out.

In the least, we should be hashing the signatures themselves if we are
going to rely on the signatures, and perhaps this would be the easiest
immediate fix. Signatures are already downloaded as source files, so we
could just calculate the hashsum of the signature file and include that
in DETAILS the way we would for normal secondary sources, couldn't we?

-- 
Justin "flux_control" Boffemmyer
Cauldron wizard and general mage
Source Mage GNU/Linux
http://www.sourcemage.org

Attachment: pgpNNRY0iETDq.pgp
Description: PGP signature