Public SourceMage Discussion List

[Bor Kraljič <pyrobor AT ver.si>]

On 13. of Oct 2011 11:30:18 flux <flux AT sourcemage.org> wrote:
> Ladislav Hagara (ladislav.hagara AT unob.cz) wrote [11.10.13 10:29]:
> > Hi,
> > 
> > I several times mentioned I have a problem with gpg checking of source
> > tarballs of small projects. If sources are signed by some gpg key it
> > doesn't mean we have to trust it imediately. We don't know the authors
> > personally, we don't know how they care about theirs keys. If attacker
> > gain developers private key, he is able to edit and sign for example
> > configure with "rm -rf /*" and we aren't able to detect it.
> > 
> > Another problem is that even well known projects time to time update
> > their sources without new version release. With our own signatures or
> > sha512 we are able to detect the sources were changed. With only vendor
> > gpg checking we are not able to detect it. For example I have two
> > different openssh-5.9p1.tar.gz tarbals with correct signatures.
> > 
> > # ls -l 1/openssh-5.9p1.tar* 2/openssh-5.9p1.tar.gz*
> > -rw-r--r-- 1 root root 1109995 Sep  6 07:36 1/openssh-5.9p1.tar.gz
> > -rw-r--r-- 1 root root     188 Sep  6 07:36 1/openssh-5.9p1.tar.gz.asc
> > -rw-r--r-- 1 root root 1110014 Sep  7 07:39 2/openssh-5.9p1.tar.gz
> > -rw-r--r-- 1 root root     188 Sep  7 07:39 2/openssh-5.9p1.tar.gz.asc
> > 
> > Do you have fixed openssh installed?
> > 
> > I suggest we add second checking for vendor gpg checking, vendor
> > signature with our own signature or sha512. Of course we can also
> > download vendor gpg signature and commit it into grimoire with
> > version++. If remote source tarballs is changed the checking with local
> > signature fails.
> > 
> > Time and will to "fix" this?
> 
> This is a good idea. I'll simply add that I think security checking
> should be different from hashing in general (i.e., in all cases).
> Hashing is to make sure that content is the same. Security checking is
> to make sure that content is correct (free from backdoors, etc.). Often
> the two coincide, but not by definition. This means that even SMGL gpg
> keys cannot be trusted for ensuring that a given tarball is the "same"
> as another, and even when we have a locally signed spell source we
> should still have a hash of it. Thus, I'd opt for having hashes always
> required and having signatures as partially-optional, in the sense that
> if there is no upstream or local signature it's left out (or given a
> dummy value like WORKS_FOR_ME or whatever), but if there is a signature
> available then it must be added. Sure this is more work for spell
> updaters, but it's also more correct, as shown by the problem Ladislav
> is pointing out.
> 
> In the least, we should be hashing the signatures themselves if we are
> going to rely on the signatures, and perhaps this would be the easiest
> immediate fix. Signatures are already downloaded as source files, so we
> could just calculate the hashsum of the signature file and include that
> in DETAILS the way we would for normal secondary sources, couldn't we?
So instead of SOURCE2_IGNORE=signature we just add SOURCE2_HASH=sha512?

I agree. This is the easiest way. And also protects us from stealth upgrades 
and all the things Lace is mentioning.

That way we can still follow "Upstream keys are always required if 
available."  
policy.