Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] gpg checking, ...

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Bor Kraljič <pyrobor AT ver.si>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] gpg checking, ...
  • Date: Thu, 13 Oct 2011 09:55:50 +0200

On 13. of Oct 2011 3:15:03 Ladislav Hagara <ladislav.hagara AT unob.cz> wrote:
> Hi,
>
> I several times mentioned I have a problem with gpg checking of source
> tarballs of small projects.
Upstream keys are always required if available. [1] That is our current
policy. Also base on what do you are talking about just small projects? As we
know kernel.org had security breach. And that is pretty massive project...
(Don't know the details about that security breach. Just want to point out
that not only small projects are affected.)
> If sources are signed by some gpg key it
> doesn't mean we have to trust it imediately. We don't know the authors
> personally, we don't know how they care about theirs keys. If attacker
> gain developers private key, he is able to edit and sign for example
> configure with "rm -rf /*" and we aren't able to detect it.
I have given example from real life on IRC and will copy it here:
If a new car has bad breaks. The factory is to blame not the dealer that sold
you brand new car....
We are of course just a dealers of programs...
>
> Another problem is that even well known projects time to time update
> their sources without new version release. With our own signatures or
> sha512 we are able to detect the sources were changed. With only vendor
> gpg checking we are not able to detect it. For example I have two
> different openssh-5.9p1.tar.gz tarbals with correct signatures.
>
> # ls -l 1/openssh-5.9p1.tar* 2/openssh-5.9p1.tar.gz*
> -rw-r--r-- 1 root root 1109995 Sep 6 07:36 1/openssh-5.9p1.tar.gz
> -rw-r--r-- 1 root root 188 Sep 6 07:36 1/openssh-5.9p1.tar.gz.asc
> -rw-r--r-- 1 root root 1110014 Sep 7 07:39 2/openssh-5.9p1.tar.gz
> -rw-r--r-- 1 root root 188 Sep 7 07:39 2/openssh-5.9p1.tar.gz.asc
>
> Do you have fixed openssh installed?
>
> I suggest we add second checking for vendor gpg checking, vendor
> signature with our own signature or sha512. Of course we can also
> download vendor gpg signature and commit it into grimoire with
> version++. If remote source tarballs is changed the checking with local
> signature fails.
So you want to have upstream gpg checking just for user information?
Do you have in mind that only if spell passes our verification it continues
with casting?
Do you wish to have that with all the spells?
>
> Time and will to "fix" this?
If we decide to fix this we need first to correct "Source Integrity Checking
Standards". We can't have written down some kind of rule but we do something
completely different. So the correct path would be IMHO to first modify
Standards. And then continue to work according to standards. I however don't
know what is our policy on modifying Standards.


[1] http://wiki.sourcemage.org/Source_Integrity_Checking_Standards




Archive powered by MHonArc 2.6.24.

Top of Page