[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 20 Aug 2013 18:57:04 +0200
From: Magnus Hagander <magnus@...ander.net>
To: kseifried@...hat.com, Devrim Gunduz <devrim@...duz.org>
Cc: oss-security@...ts.openwall.com,
"Eric H. Christensen" <echriste@...hat.com>, "security@...tgresql.org" <security@...tgresql.org>, kevin@...ye.com
Subject: Re: [pgsql-security] Re: PostgreSQL insecure install
via yum (multiple problems)
Adding Devrim Gunduz who is the maintainer of the PostgreSQL yum repository.
On Tue, Aug 20, 2013 at 6:11 AM, Kurt Seifried <kseifried@...hat.com> wrote:
> On 08/19/2013 07:19 PM, Eric H. Christensen wrote:
>> On Mon, Aug 19, 2013 at 06:58:22PM -0600, Kurt Seifried wrote:
>>> Signing RPM's isn't very useful if you never make the signing
>>> key available!
>>
>> You mean like this:
>> http://keys.fedoraproject.org/pks/lookup?search=0x442df0f8&op=vindex
>>
>> I'm pretty sure pgp.mit.edu isn't the best source for PGP keys any
>> longer, unfortunately.
>
> Dunno who to ask, so adding Scrye: can we make sure Google indexes the
> Fedora key server? This actually raises a good point, what are the key
> servers now? The big 3 used to be:
>
> http://pgp.mit.edu/
> http://keyserver.pgp.com/
> http://sks-keyservers.net/
>
> and it's not on any of them =( Even if the key is uploaded PostgreSQL
> doesn't list the key fingerprint anywhere securely, the key ID can be
> spoofed, so yeah there might be keys with the ID 442df0f8 but I got no
> clue if they're legitimate or not =(.
>
> Really all we need is an HTTPS server (easy) and a web page listing
> the key/fingerprint, ideally the full text of the key. I understand
> small projects may not do this, but PostgreSQL is pretty big and
> professional.
Agreed, we should. Regardless of it being on the proper keyservrers or
not. In fact, we do this for Debian/Ubuntu already at
https://www.postgresql.org/media/keys/ACCC4CF8.asc. The intention was
to do it for the rpm keys as well, but that seems to have slipped off
the todo list somehow.
Devrim, can you provide the key for this, and update the instructions
accordingly? I believe you have the required commit bit on the website
repository, but if not, send me the keyfile as it should be, and I can
apply it for you (and of course, confirm out of band what the
fingerprint is of the correct key).
Thanks!
--
Magnus Hagander
PostgreSQL Core Team
Me: http://www.hagander.net/
Work: http://www.redpill-linpro.com/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
