Public SourceMage Discussion List

[Remko van der Vossen <wich AT yuugen.jp>]

On 平成23/12/01, at 23:46, flux <flux AT sourcemage.org> wrote:

> Remko van der Vossen (wich AT yuugen.jp) wrote [11.12.01 22:31]:
>> On Thu, Dec 01, 2011 at 12:03:52AM -0500, Sukneet Basuta wrote:
>>> I don't think there is any argument against the fact that upstream
>>> signed sources are better than hashes.
>> 
>> There most certainly is an argument against that, which is that upstream
>> signatures are not under our control, whereas hashes (being part of the
>> grimoire) are. The difference is that with upstream signatures we have
>> no verification in place which would catch a compromised source archive
>> signed by a compromised signature. The grimoire only points to locations
>> outside our control for both the source archive as well as the
>> signature, which could easily be replaced by a third party, or even the
>> original developer who, for whichever reason decides to fsck with
>> everybody.
>> 
>> As flux mentioned, what we would like to have in the case of upstream
>> signatures is use the upstream signature and add a hashsum as well for
>> either the source archive or the signature. That way the source is
>> authenticated by the developer and verified by us, leaving no way for
>> anyone outside SMGL to compromise our users' systems indirectly by
>> compromising developers whose code we refer to in our grimoire.
> 
> Note that there is still the possibility that our systems could be
> compromised, which would invalidate any and all SMGL-generated
> signatures and hashes, until everything was revalidated. The fact that
> it is outside our control doesn't inherently make it any less (nor any
> more) secure. We are equally unable to catch a compromised source
> archive that was signed with a compromised SMGL signature (or tagged
> with a compromised SMGL hashsum).
> 
> The problem isn't really about upstream vs. SMGL-local, but rather about
> having a single point of failure. Having multiple locations from which
> to verify the same source (upstream signature plus "local" hash of the
> signature is one example/possibility) improves the system by shielding
> against the single point of failure problem.
> 
> For what it's worth, I know of no distribution that provides anything
> better than a single point of failure verification/authentication of
> sources/packages (if even that, as there are also distros that do no
> verification/authentication at all). Granted OpenBSD takes their audits
> very seriously, but I suppose that is ultimately also a single point of
> failure (feel free to correct me if I'm wrong).
> 
> -- 
> Justin "flux_control" Boffemmyer
> Cauldron wizard and general mage
> Source Mage GNU/Linux
> http://www.sourcemage.org
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss