Re: [RFH] The need for signed packages and signed Releases (long, long)
On Thu, Nov 14, 2002 at 12:25:40AM +1000, Anthony Towns wrote:
> > i also think that when signing releases it is important to timestamp
> > them and touch-resign them in fixed intervals, so you can be sure that
> > you are not getting a stale release file.
>
> While doing all this copious thinking, you might like to do something like
>
> $ lynx -dump http://ftp.debian.org/dists/sid/Release | grep Date:
> Date: Tue, 12 Nov 2002 20:38:39 UTC
>
> just to see if your thoughts are actually anything new.
which leaves the second part. if you timestamp and sign a release file
you only say that it has been a "good" release at some time. if you want
to narrow the window of opportunity for someone to hand me an old
release file and an according package with known security flaws you need
to make new release files peridoically, even if nothing in it has
changed, and the script that checks this has to be aware of this fact
and warn you if you get a release file that is older than that. unstable
and testing change often enough, but stable and security would need this
mechanism, which also means that you need something like apt-pupdate so
you don't have to download the release file because of the new
timestamp.
> > i have the impression that a lot of people don't realise how important
> > this is. don't you get shivers everytime you do an apt-get upgrade and
>
> No, I don't, since I've trained myself to type `apt-check-sigs' after
> ever `apt-get update'. (And the only debs I install through anything
> other than apt are ones I've made myself these days)
but it should be much easier to train apt to do that then train every
single user to do so. hopefully there will be more non-technical users
among those that use debian in the future and, apart from being ignorant
about things like signed packages, it's unlikely that they install and
use a package to check the sigs if they don't have to.
in the moment i also have only apt-gotten and locally built packages,
but that has also been different at times. and if someone chooses to use
debs to distribute his software we should appreciate that and give her
the opportunity to deliver it to her users in a secure way, even if it
is not in the debian distribution. and therefore signed debs would be
nice. but i accept that signed releases would do most of the time and
are a good step into the right direction.
last but not least i don't understand why you could have a problem with
the things descirbed above, because we don't trade anything in for it.
or only extremly little.
regards robert
Reply to: