Skip to Content.
Sympa Menu

sm-sorcery-bugs - [SM-Sorcery-Bugs] [Bug 7838] sorcery and grimoire tarballs should be created with gpg signatures

sm-sorcery-bugs AT lists.ibiblio.org

Subject: Bugs for Sorcery are reported here

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-sorcery-bugs AT lists.ibiblio.org
  • Subject: [SM-Sorcery-Bugs] [Bug 7838] sorcery and grimoire tarballs should be created with gpg signatures
  • Date: Mon, 7 Feb 2005 12:07:27 -0800 (PST)

http://bugs.sourcemage.org/show_bug.cgi?id=7838





------- Additional Comments From acedit AT armory.com 2005-02-07 12:07 -------
Partially yes.

The mirrors would download the grimoire/sorcery tarballs and the associated
signature file and mirror both of them. The signature guarantees that it was
signed by us [0].

The mirror would then only be able to mirror things we signed /at some point/.
The administration problem of mirroring out of date tarballs will remain.
We'll
just have a guarantee that what they mirror was at some point what we
considered
current. So if theres a security breach (in our stuff) that gets automatically
signed (or unknowingly signed by one of us) they can mirror it until we get
them
off our mirror lists, which would likely be in sorcery, which they can just
not
update either. Or if theres a security hole in a third party (say sendmail or
something) then they can just mirror the old grimoire with that hole in it
forever and launch targetted attacks on people who are getting that grimoire
from them (and prusumably some of them wont have caught on).

So this will make it "more secure" than it is now, currently anyone can mirror
anything, which is really bad. But theres definitly still ways to exploit this
gpg scheme through other means.

We really need a means to make our tarballs expire, but thats a different
problem.

[0] where "us" and "we" is defined as an automated script using private keys
on
the primary mirror, or a team lead on their personal machine using a key pair
listed in the appropriate keyring from sorcery-pubkeys.

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.




Archive powered by MHonArc 2.6.24.

Top of Page