FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Gentoo > Gentoo Development

 
 
LinkBack Thread Tools
 
Old 11-30-2009, 08:18 PM
Richard Freeman
 
Default GPG Infrastructure for Gentoo (Was Council Meeting)

Antoni Grzymala wrote:

How about getting back to GLEP-57 [1]? Robin Hugh Johnson made an effort
a year ago to summarize the then-current state of things regarding tree
and package signing, however the matter seems to have lain idle and
untouched for more than a year since.



One concern I have with the GLEP-57 is that it is a bit hazy on some of
the implementation details, and the current implementation has some
weaknesses.


I go ahead and sign my commits. However, when I do this I'm signing the
WHOLE manifest. So, if I stabilize foo-1.23-r5 on my arch, at best I've
tested that one particular version of that package works fine for me.
My signature applies to ALL versions of the package even though I
haven't tested those.


Now, if we had an unbroken chain of custody then that wouldn't be a
problem. However, repoman commit doesn't enforce this and the manifest
file doesn't really contain any indication of what packages are assured
to what level of confidence.


If we want to sign manifests then the only way I see it actually
providing real security benefits is if either:


1. The distro does this in the background in some way in a secure
manner (ensuring it happens 100% of the time).


2. Every developer signs everything 100% of the time (make it a QA
check).


The instant you have a break in the signature chain you can potentially
have a modification. If somebody cares enough to check signatures, then
they're going to care that the signature means something. Otherwise it
only protects against accidental modifications, and the hashes already
provide pretty good protection against this.
 

Thread Tools




All times are GMT. The time now is 01:03 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org