Re: A thought experiment regarding tag2upload and trust
Scott Kitterman <debian@kitterman.com> writes:
> I think if you want to step away from the implementation details, the
> more abstract point is that you don't need data from outside the archive
> (or a mirror of the archive) in order to verify that the source package
> you downloaded has not been modified since then and who uploaded it.
tag2upload provides all of this. It provides both a verification that the
source package has not been modified and detailed information on who
uploaded it.
The information it provides is not trustworthy if the tag2upload server
has been compromised. The signature on the the *.dsc file today is not
trustworthy if the system on which the uploader generated the source
package has been compromised. I consider these to be parallel cases
since, in the tag2upload design, the tag2upload server *is* the system on
which the maintainer directs the construction the source package.
The design replaces a highly hetrogenous variety of workflows with a
centralized system that is also a centralized attack target. This has
various security properties and trade offs about which we can disagree.
But that disagreement necessarily requires some nuance to state it
precisely. People keep trying to discard the nuance and, as a result, at
least in my opinion, make claims that are either incorrect or simplified
to the point of uselessness.
> As it happens though you can't tell if what's in the archive matches the
> uploader intent with tag2upload either.
Correct, and this is exactly why I said that I don't consider this a
useful way to talk about security guarantees.
With tag2upload, you can trace the provenance of the source package
*closer* to maintainer intent, and to a much richer format that is easier
to audit. I think this is a security benefit.
> All you can vet is that the tag2upload service claims it does. You may
> think that's better, but neither of them are entirely free of risk.
I completely agree with this.
--
Russ Allbery (rra@debian.org) <https://www.eyrie.org/~eagle/>
Reply to: