Re: .deb integrity check
From: Hugo Haas <hugo@debian.org>
> I have realised that dpkg can't check the package integrity. Somebody could
> crack ftp.debian.org, put a new login package and get tons of passwords.
Even more so - crack to one/some of the numerous mirrors and change
the package there, not as bad as your scenario but still possible.
The point is that master.debian.org isn't the only link on the chain
which can be broken in order to achieve this.
> I think it would be interesting to PGP-sign the md5sums file included in
> the packages with a Debian key and add an option to check this signature.
It should be somehow possible to verify WHICH key should be verified,
and be able to obtain this in an independent way (i.e. if the package
is modified, and the key to be verified is directed to the cracker's
key then your verification wouldn't reveal this, would it?).
Maybe a signature on the Packages file is required as well?
Cheers,
--Amos
--Amos Shapira | "Of course Australia was marked for
| glory, for its people had been chosen
amos@gezernet.co.il | by the finest judges in England."
| -- Anonymous
Reply to: