[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 22 Apr 2013 08:26:51 +1000
From: Allan McRae <allan@...hlinux.org>
To: oss-security@...ts.openwall.com
Subject: Re: upstream source code authenticity checking
On 21/04/13 06:39, Solar Designer wrote:
> Hi,
>
> I just found this recent blog post by Allan McRae of Arch Linux:
>
> http://allanmcrae.com/2012/04/how-secure-is-the-source-code/
>
> Thank you for doing this, Allan! Are you contacting the upstream
> authors to request that they start to properly sign their releases?
> (I've been doing that on some occasions, sometimes with success.)
I have for a couple, but nothing across the whole board.
> I think that placing both "MD5 checksum provided on same site as
> download" and "PGP signature, key difficult to verify" in the same
> "yellow" category is inconvenient for us. "MD5 checksum provided on
> same site as download" only helps verify downloads from mirrors against
> the master site, whereas "PGP signature, key difficult to verify"
> achieves a lot more - once a distro is already including the package
> (and has already taken the risk of it having been tampered with), then
> verifying further updates to the package becomes almost as reliable as
> it would have been with proper signing (with a "readily verifiable" key).
> So we need four categories, or simply "MD5 checksum provided on same
> site as download" should be in "red", not in "yellow".
I had yellow as "at least they tried...". The could be categorised in
other ways, but that was a really quick survey of some core Linux
software, so I did not put that much thought into it.
Allan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
