Security bugs are reported here via bugzilla

[Seth Woolley <seth AT tautology.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Yep, I implemented the gpg signing for the linux spell ;)

Here's my note that I wrote down a bit ago:

===

for gpg signing sources, I was thinking we have two urls, one for the
original source, another for the detached signature, and then a third
value for each source for the fingerprint of the proper public key.  Set
gpg to autofetch the public key from first my server then pgp.mit.edu for
backup.  keys will be checked for both being the proper fingerprint and
being signed by a special key for signing keys we trust for our sources.
The fingerprint's purpose is to restrict trust to only their spells (so
they can't trojan another spell).  I want people who cast sendmail to be
trusting sendmail, not joe blow whose key we happened to sign since he has
a spell in our grimoire.

the point of checking for our signature is in case somebody tries to
insert a fingerprint for a key that we don't trust into a grimoire.  They
have to insert code into our grimoire to replace the fingerprint and get
it signed by our key.

this is important because with md5s you've isolated the breaks to a known
tarball -- people have download and run it and we restrict the possible
entry points to a really small amount.  With gpg signing we have to be
extra careful because somebody could get somebody elses key (like steal
sendmail's private key) and if we sign it, we just can't let him have
access to our whole setup, too.

===

Now, with signing developer keys with the master key, I think we could do
that, also.  But the point would be that each key that we trust would be
trusted by the main key.  Otherwise, we'd trust random people I signed,
even though I don't trust them, I only know their identity.


BTW, I was never going to remove md5s, just add on gpg ability:

SOURCE=original.tar.gz
SOURCE2=original.tar.gz.sign
MD5[0]=gpg
MD5[1]=3456 4534 3453 3453  3454 3543 3453 3453

this is easy to implement.  like I did in the linux spell, you overload
unpack() with more arguments, passing SOURCE MD5[0] SOURCE2 MD5[1] instead
of just SOURCE MD5[0]

At any point you could change "gpg" to an md5 value in DETAILS, and the
unpack will gracefully fall back.

(the linux spell is slightly different.  Since it was for one spell only,
I just made a kernel.gpg file with the gpg-style keyring including
the public key of kernel.org, and instead of MD5[1] being the fingerprint,
it was the filename "kernel.gpg".)

Seth

On Wed, 14 May 2003, Eric Sandall wrote:

> Seth Woolley said:
> > http://www.cryptnet.net/fdp/crypto/strong_distro.html
>
> Interesting idea.  Theoretically this wouldn't take much work, just
> replace all of the md5 checks with gpg checks and setup an SMGL
> signature-only key and have the developers sign it, as well as having
> theirs signed by it.
>
> The linux spell already implements this somewhat.
>
> Now, I just need to find a webmail that allows GPG encryption and works.  :(
>
> -One of Four
> a.k.a. sandalle
>
> --
> PGP Key Fingerprint:  FCFF 26A1 BE21 08F4 BB91  FAED 1D7B 7D74 A8EF DD61
> http://search.keyserver.net:11371/pks/lookup?op=get&search=0xA8EFDD61
>
> Eric Sandall                     |  Source Mage GNU/Linux Developer
> eric AT sandall.us                  |  http://www.sourcemage.org/
> http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
> http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
> _______________________________________________
> SM-Security mailing list
> SM-Security AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-security
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+wtCL7fQ833vqzH0RAtDbAJ0UxfmWUpyl5h7uRmg4zLacSGEaTQCfRIdB
AbgTVDwxhxcFHyU36+kbH1U=
=IZyF
-----END PGP SIGNATURE-----