oss-security - upstream source code authenticity checking

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130420203939.GB31505@openwall.com>
Date: Sun, 21 Apr 2013 00:39:39 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: upstream source code authenticity checking

Hi,

I just found this recent blog post by Allan McRae of Arch Linux:

http://allanmcrae.com/2012/04/how-secure-is-the-source-code/

Thank you for doing this, Allan!  Are you contacting the upstream
authors to request that they start to properly sign their releases?
(I've been doing that on some occasions, sometimes with success.)

I think that placing both "MD5 checksum provided on same site as
download" and "PGP signature, key difficult to verify" in the same
"yellow" category is inconvenient for us.  "MD5 checksum provided on
same site as download" only helps verify downloads from mirrors against
the master site, whereas "PGP signature, key difficult to verify"
achieves a lot more - once a distro is already including the package
(and has already taken the risk of it having been tampered with), then
verifying further updates to the package becomes almost as reliable as
it would have been with proper signing (with a "readily verifiable" key).
So we need four categories, or simply "MD5 checksum provided on same
site as download" should be in "red", not in "yellow".

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.