Public SourceMage Discussion List

[flux <flux AT sourcemage.org>]

Remko van der Vossen (wich AT yuugen.jp) wrote [11.12.01 22:31]:
> On Thu, Dec 01, 2011 at 12:03:52AM -0500, Sukneet Basuta wrote:
> > I don't think there is any argument against the fact that upstream
> > signed sources are better than hashes.
> 
> There most certainly is an argument against that, which is that upstream
> signatures are not under our control, whereas hashes (being part of the
> grimoire) are. The difference is that with upstream signatures we have
> no verification in place which would catch a compromised source archive
> signed by a compromised signature. The grimoire only points to locations
> outside our control for both the source archive as well as the
> signature, which could easily be replaced by a third party, or even the
> original developer who, for whichever reason decides to fsck with
> everybody.
> 
> As flux mentioned, what we would like to have in the case of upstream
> signatures is use the upstream signature and add a hashsum as well for
> either the source archive or the signature. That way the source is
> authenticated by the developer and verified by us, leaving no way for
> anyone outside SMGL to compromise our users' systems indirectly by
> compromising developers whose code we refer to in our grimoire.

Note that there is still the possibility that our systems could be
compromised, which would invalidate any and all SMGL-generated
signatures and hashes, until everything was revalidated. The fact that
it is outside our control doesn't inherently make it any less (nor any
more) secure. We are equally unable to catch a compromised source
archive that was signed with a compromised SMGL signature (or tagged
with a compromised SMGL hashsum).

The problem isn't really about upstream vs. SMGL-local, but rather about
having a single point of failure. Having multiple locations from which
to verify the same source (upstream signature plus "local" hash of the
signature is one example/possibility) improves the system by shielding
against the single point of failure problem.

For what it's worth, I know of no distribution that provides anything
better than a single point of failure verification/authentication of
sources/packages (if even that, as there are also distros that do no
verification/authentication at all). Granted OpenBSD takes their audits
very seriously, but I suppose that is ultimately also a single point of
failure (feel free to correct me if I'm wrong).

-- 
Justin "flux_control" Boffemmyer
Cauldron wizard and general mage
Source Mage GNU/Linux
http://www.sourcemage.org

Attachment: pgpnWj6uX0bud.pgp
Description: PGP signature