[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <8738swpga4.fsf@windlord.stanford.edu>
Date: Wed, 05 Jun 2013 11:24:19 -0700
From: Russ Allbery <rra@...nford.edu>
To: oss-security@...ts.openwall.com
Cc: audreyt@...reyt.org
Subject: Re: CVE-2013-2145: perl Module::Signature code execution vulnerability
Vincent Danen <vdanen@...hat.com> writes:
> I've suggested to upstream that if they want this to be used seriously
> for trust (and not just verifying that the distribution is untampered
> with, according to whomever was able to sign the SIGNATURE file), that
> they should disable the auto-retrieval of keys by default and/or CPAN
> should manage their own keyserver of trusted keys and cpansign should
> only pull from that keyserver. The first is probably practical enough
> to do, the second I'm not so sure.
Speaking as a CPAN author, the second would be awesome. For bonus points,
once one registers a key with CPAN, CPAN could then even check one's
uploads and disallow uploads that aren't signed with the proper key.
It would require work by the CPAN maintainers, but the general
infrastructure is in place to do things like this and one could bootstrap
from CPAN username/password.
--
Russ Allbery (rra@...nford.edu) <http://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
