Re: fakeroot a solution for multi-architecture building?
> joost witteveen <joost@rulcmc.leidenuniv.nl> wrote:
> > Now comes the (simple) attac: just exploit the samba bugs on alpha-build,
> > and you are now able to create packages that dinstall will trust.
> > (if alpha build can do it automatically, then surely someone who broke
> > root can do it). So, you simply remove those silly checks for pgp-correctness
> > of the developpers, and you make it create any package you like, that
> > does whatever you like, and let alpha-build sign it with the pgp key
> > that dinstall trusts, and let alpha-build upload it to master.
>
> This can also happen on regular developer's machines. [It's not
> as if the developer routinely audits the source to see if it's
> been altered.]
True, but at least then the package isn't uploaded yet.
The (admittedly not very big) difference is that the developper may/should
notice the breakin (OK, that may be difficult), and, after he found his
system was corrupted, he can at least distrust his debian sources.
> The solution is auditing, of course. If someone runs packages in a
> quarantine area, and notes (and reports) any unusual behavior, that
> would be a good thing (and not too hard to implement). The more and more
> varied these quarantine are, the better.
And they should all have system names like "picard.cistron.nl" and have
excactly the same HD's installed as picard etc. _If_ I'm ever going
to attac in a way like that, I'm gonna make sure the package I build
checks for the hostname (and some hardware things) of the host I want
to "rm -rf /".
> Finally, it would be good to have a *simple* program to compare
> binaries. This way, independently generated binaries could
> be held up against each other. I believe this is an unmet need.
> [Anything based on libbfd doesn't qualify, I suspect.]
This I wholehartedly agree with. (Although I'm not sure the programme
has to be simple, just dinstall only accepting a .deb+.changes if
there are at least some number, and then checking with whatever
library it wants to see if the binaryies/scripts/files are identical
would be a good thing).
--
joost witteveen, joostje@debian.org
#!/usr/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj
$/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1
lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)
#what's this? see http://www.dcs.ex.ac.uk/~aba/rsa/
--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-devel-request@lists.debian.org .
Trouble? e-mail to templin@bucknell.edu .
Reply to: