W dniu pon, 02.07.2018 o godzinie 17∶36 +0200, użytkownik Jason A. Donenfeld napisał: > Hey guys, > > While our infrastructure team has some nice technical competence, the > recent disaster and ongoing embarrassing aftermath has made ever more > urgent the need to have end-to-end signatures between developers and > users. While the infrastructure team seems fairly impressive at > deploying services and keeping the house running smoothly, I'd rather > we don't place additional burden on them to do everything they're > doing securely. Specifically, I'd like to ensure that 100% of Gentoo's > infrastructure can be hacked, yet not backdoor a single witting user > of the portage tree. Right now, as it stands, rsync distributes > signatures to users that are derived from some > infrastructure-controlled keys, not from the developers themselves. > > Proposal: > - Sign every file in the portage tree so that it has a corresponding > .asc. Repoman will need support for this. > - Ensure the naming scheme of portage files is sufficiently strict, so > that renaming or re-parenting signed files doesn't result in RCE. [*] > - Distribute said .asc files with rsync per usual. >
Another problem: how do you prevent attacks based on removing files? For example, let's say a MITM that removes new version of some packages and related GLSAs in order to force the user to stay at vulnerable version. -- Best regards, Michał Górny
signature.asc
Description: This is a digitally signed message part
