Greetings all,
In order to make the client check signatures by default, we need a way
for existing clients (and future clients) to know what certificates a
publisher uses, and to be aware when those certificates change.
The proposal is for clients to refresh the publisher metadata when they
refresh the publisher's catalog. While the proposal creates the
mechanism to refresh any and all publisher information, for now, only
the certificate information and information needed to verify the
metadata will be updated in the client. The certificate information has
been designed so that updates to the publisher's automatic information
will not effect any user specified changes (such as approving or
revoking a certificate).
To offset the potential for a man-in-the-middle attack which changed
publisher metadata, there will be a capacity for the repo admin to sign
publisher responses. Publisher meta data updates will only be allowed
for signed responses. The information needed to validate the response
(like intermediate cert, encoding, algorithm, etc...) will be included
in the response. The response will have to validate against either a
trust anchor on the system, or a manually approved certificate for that
publisher.
To sign publisher responses, the repo admin will run a command like
'pkgrepo sign-pub-responses' (exact command name tbd) which will take
(roughly) the same arguments as pkgsign. Whenever a publisher property
is changed, the administrator will have to resign responses for that
publisher and will be reminded of this. In the future, there's potential
for optionally storing a key location somewhere which would be used to
update the publisher response when a property is changed.
Thoughts and comments appreciated.
Thanks,
Brock
_______________________________________________
pkg-discuss mailing list
[email protected]
http://mail.opensolaris.org/mailman/listinfo/pkg-discuss
