oss-sec mailing list archives
Re: [pgsql-security] Re: [oss-security] PostgreSQL insecure install via yum (multiple problems)
From: Magnus Hagander <magnus () hagander net>
Date: Tue, 20 Aug 2013 18:57:04 +0200
Adding Devrim Gunduz who is the maintainer of the PostgreSQL yum repository. On Tue, Aug 20, 2013 at 6:11 AM, Kurt Seifried <kseifried () redhat com> wrote:
On 08/19/2013 07:19 PM, Eric H. Christensen wrote:On Mon, Aug 19, 2013 at 06:58:22PM -0600, Kurt Seifried wrote:Signing RPM's isn't very useful if you never make the signing key available!You mean like this: http://keys.fedoraproject.org/pks/lookup?search=0x442df0f8&op=vindex I'm pretty sure pgp.mit.edu isn't the best source for PGP keys any longer, unfortunately.Dunno who to ask, so adding Scrye: can we make sure Google indexes the Fedora key server? This actually raises a good point, what are the key servers now? The big 3 used to be: http://pgp.mit.edu/ http://keyserver.pgp.com/ http://sks-keyservers.net/ and it's not on any of them =( Even if the key is uploaded PostgreSQL doesn't list the key fingerprint anywhere securely, the key ID can be spoofed, so yeah there might be keys with the ID 442df0f8 but I got no clue if they're legitimate or not =(. Really all we need is an HTTPS server (easy) and a web page listing the key/fingerprint, ideally the full text of the key. I understand small projects may not do this, but PostgreSQL is pretty big and professional.
Agreed, we should. Regardless of it being on the proper keyservrers or not. In fact, we do this for Debian/Ubuntu already at https://www.postgresql.org/media/keys/ACCC4CF8.asc. The intention was to do it for the rpm keys as well, but that seems to have slipped off the todo list somehow. Devrim, can you provide the key for this, and update the instructions accordingly? I believe you have the required commit bit on the website repository, but if not, send me the keyfile as it should be, and I can apply it for you (and of course, confirm out of band what the fingerprint is of the correct key). Thanks! -- Magnus Hagander PostgreSQL Core Team Me: http://www.hagander.net/ Work: http://www.redpill-linpro.com/
Current thread:
- PostgreSQL insecure install via yum (multiple problems) Kurt Seifried (Aug 19)
- Re: PostgreSQL insecure install via yum (multiple problems) Landon Hurley (Aug 19)
- Re: PostgreSQL insecure install via yum (multiple problems) Kurt Seifried (Aug 19)
- Re: PostgreSQL insecure install via yum (multiple problems) Eric H. Christensen (Aug 19)
- Re: PostgreSQL insecure install via yum (multiple problems) Kurt Seifried (Aug 19)
- Re: PostgreSQL insecure install via yum (multiple problems) Kevin Fenzi (Aug 19)
- Re: [pgsql-security] Re: [oss-security] PostgreSQL insecure install via yum (multiple problems) Magnus Hagander (Aug 20)
- Re: PostgreSQL insecure install via yum (multiple problems) Daniel Kahn Gillmor (Aug 20)
- Re: PostgreSQL insecure install via yum (multiple problems) Moritz Naumann (Aug 19)
- Re: PostgreSQL insecure install via yum (multiple problems) Kurt Seifried (Aug 19)
- Re: PostgreSQL insecure install via yum (multiple problems) Landon Hurley (Aug 19)