Russ Allbery dijo [Sat, Jun 15, 2024 at 11:44:35PM -0700]: > A tag2upload server compromise is fairly serious. A compromise of any of > tag2upload, dak, or the buildds have roughly equally serious potential > impact on the archive as far as I can tell, although the details differ. > In all three cases, you need reproducible builds to reliably detect the > compromise, although in the tag2upload case you only need reproducible > source builds for the specific set of source transformations that > tag2upload is willing to perform, which I believe is a much easier problem > than the reproducible binary builds required to detect buildd or dak > compromises. dak, uniquely, can meddle with either source *or* binary > packages, but dak meddling with source packages will break the signatures > on those packages, so is somewhat easier to detect than dak meddling with > binary packages.
This paragraph can even enable what could amount to an interesting synergy. More than one tag2upload instance can be set up. Due to its architecture, they can be non-internet-accessible systems (naturally, they will require to _access_ the network, or at least Salsa). This can be paired with the requirement that all uploads made via tag2upload are reproducible. Because, if they are, dak can be made to take a tag2upload-provided package as valid only if two identical packages are presented, built by at least two independent tag2upload instances.
