oss-sec mailing list archives
Re: validation on update
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 03 Mar 2015 08:40:27 -0700
On 03/03/15 03:32 AM, gremlin () gremlin ru wrote:
On 2015-03-02 19:24:30 +0000, Simon McVittie wrote: > An end-to-end integrity check from the original publisher to > the consumer would prevent more attacks, but would also be > harder to deploy (it requires action from each publisher, Running `gpg --detach-sign < package.tar.gz > package.tar.gz.sig` (or, better, `gpg -ba ...`) on each release isn't a big deal... > verification at each consumer, Running `gpg --verify package.tar.gz.sig package.tar.gz` will do that just perfectly. And, when talking about automatic updates, that should be included into the update procedure. > and a way to determine whether publisher X is authorized to > publish package Y); `gpg --no-default-keyring --keyring /path/authors.pub --verify ...`
No but key distribution and management is a real problem. How does upstream sign all these things securely but also conveniently on their end? How do they store the key (Hardware Security Module?). How does upstream distribute the key (just HTTPS website? in the maven source? hope nobody spoofs them. There's a simple reason most projects don't sign software, key management is such a pain (how do you security backup something that should only exist in one spot? Encrypt it? Ok how do you secure that key... Not saying it shouldn't be done, but just pointing out it's a little more work than running "gpg --sigh". Does anyone have any good guidelines/procedure docs on this stuff? E.g. which HSM devices support GPG, etc? -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- CVE request: Maven downloads JARs via HTTP Martin Prpic (Mar 02)
- Re: CVE request: Maven downloads JARs via HTTP gremlin (Mar 02)
- Re: CVE request: Maven downloads JARs via HTTP Martin Prpic (Mar 02)
- Re: CVE request: Maven downloads JARs via HTTP gremlin (Mar 02)
- Re: CVE request: Maven downloads JARs via HTTP Simon McVittie (Mar 02)
- Re: validation on update gremlin (Mar 03)
- Re: validation on update Kurt Seifried (Mar 03)
- Re: CVE request: Maven downloads JARs via HTTP Martin Prpic (Mar 02)
- Re: CVE request: Maven downloads JARs via HTTP gremlin (Mar 02)