Skip to Content.
Sympa Menu

sm-security - Re: [SM-Security] openPGP security by signing

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Seth Woolley <seth AT tautology.org>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: sm-security AT lists.ibiblio.org
  • Subject: Re: [SM-Security] openPGP security by signing
  • Date: Wed, 14 May 2003 21:48:17 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 14 May 2003, Sergey A. Lipnevich wrote:

>
> Seth Woolley wrote:
>
> >BTW, I was never going to remove md5s, just add on gpg ability:
> >
> >SOURCE=original.tar.gz
> >SOURCE2=original.tar.gz.sign
> >MD5[0]=gpg
> >MD5[1]=3456 4534 3453 3453 3454 3543 3453 3453
> >
> >this is easy to implement. like I did in the linux spell, you overload
> >unpack() with more arguments, passing SOURCE MD5[0] SOURCE2 MD5[1] instead
> >of just SOURCE MD5[0]
> >
> >
> >
> Two questions. 1. How is this going to work for spells like OpenOffice
> with 20 SOURCEs? 2. If and how is this going to be different for
> packages that provide gpg signatures (GnuPG, Apache), and those that
> don't (absolute majority of them)?
> Thanks!

These are great questions, BTW, keep me on my toes.

1) 40 sources or just use regular MD5s. (two for each source, one for the
original file, second for the detached signature).
For the ones with lots of patches, when you add gpg to it, you just
renumber them 1, 2, 3 would be 1, 3, 5 with 2, 4, 6 being the respective
signature files.
2) all MD5 sources that choose not to use gpg checking will require no
modifications. For those that do provide gpg signatures, you just do what
I said in answer 1), and then make sure that the additional args are
passed to unpack as $3 and $4.

in PRE_BUILD:

==>
unpack $SOURCE ${MD5[0]} &&
unpack $SOURCE2 ${MD5[1]}
<==

would look like:

==>
unpack $SOURCE ${MD5[0]} $SOURCE2 ${MD5[1]} &&
unpack $SOURCE3 ${MD5[2]} $SOURCE4 ${MD5[3]}
<==

in default_pre_build, we change the unpack lines to:
==>
unpack $SOURCE ${MD5[0]} $SOURCE2 ${MD5[1]} &&
<==
(because the third and fourth args are ignored if gpg is not used for
single source files, but they get passed correctly if gpg is being used)

then in libgrimoire, unpack is simply modified ever so slightly to switch
to gpg checking if it detects "gpg" as the second argument. That's it.
Nothing complicated. If it is gpg checking, _then_ it uses the third and
fourth arguments.

This means single source file spells that want to enable gpg checking just
need to add two lines to DETAILS and modify one (the MD5[0] to say "gpg").

The two lines added to DETAILS will be SOURCE2 (the detached signature)
and MD5[1] (the fingerprint of the public key of the spell's vendor).

GPG would then autodownload the public key from a couple keyservers if it
is not available already, check it, performing the three step in my
previous email, and give a diagnosis if bad, otherwise, hooray, say that
the check passed.

The spellwriter would just send me a signed email request to sign a public
key for the vendor, and after doing a basic background check (send an
email with the request to sm-security as public notice until three
developers have personally vouched for the public key by signing it, or
something like that), then I or whoever has the private key, signs it
directly and uploads the signature to public key servers.

I hope I've not become too verbose.

Seth

>
> Sergey.
>
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+wxwZ7fQ833vqzH0RAqLtAKCypkzbKGKeU3wHxrofuz9crjOb2wCeK6XN
GiTgTnh2JhOOwD2WNiMJvX8=
=37ue
-----END PGP SIGNATURE-----





Archive powered by MHonArc 2.6.24.

Top of Page