On 07/02/2018 10:16 PM, Michał Górny wrote: > W dniu pon, 02.07.2018 o godzinie 17∶36 +0200, użytkownik Jason A. > Donenfeld napisał: >> Hey guys, >> >> While our infrastructure team has some nice technical competence, the >> recent disaster and ongoing embarrassing aftermath has made ever more >> urgent the need to have end-to-end signatures between developers and >> users. While the infrastructure team seems fairly impressive at >> deploying services and keeping the house running smoothly, I'd rather >> we don't place additional burden on them to do everything they're >> doing securely. Specifically, I'd like to ensure that 100% of Gentoo's >> infrastructure can be hacked, yet not backdoor a single witting user >> of the portage tree. Right now, as it stands, rsync distributes >> signatures to users that are derived from some >> infrastructure-controlled keys, not from the developers themselves. >> >> Proposal: >> - Sign every file in the portage tree so that it has a corresponding >> .asc. Repoman will need support for this. >> - Ensure the naming scheme of portage files is sufficiently strict, so >> that renaming or re-parenting signed files doesn't result in RCE. [*] >> - Distribute said .asc files with rsync per usual. >> > > Another problem: how do you prevent attacks based on removing files? > For example, let's say a MITM that removes new version of some packages > and related GLSAs in order to force the user to stay at vulnerable > version. >
right, just to point out, this is already covered in the metamanifest signing scheme, but wouldn't be in a separate file signing mechanism. -- Kristian Fiskerstrand OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
signature.asc
Description: OpenPGP digital signature
