Bug#203741: apt-secure

[Isaac Jones <ijones@syntaxpolice.org>]

Matt Zimmerman <mdz@debian.org> writes:

> I don't think it's particularly valid for apt to complain unless it can
> actually distinguish whether it is installing packages from insecure sources
> (which it cannot).  If a warning is given when things are obviously
> insecure, users will take the lack of a warning to be a blessing.

So apt knows about insecure sources and can warn the user about that.
I'm not sure how strongly you meant the "show stopper" comment, but I
think it is far more desirable to give a transition path toward all
secure sources in the next release than to punt until we work out dpkg
issues.  There are still lots of options open for the user interface
(see below).

> I think it provides a much smoother and safer upgrade path for existing
> users, most of which will have insecure sources.  Their official Debian
> sources are automatically authenticated, and they are warned about
> everything else.

I agree that what you wanted was better.  I'm only arguing that not
having this is not, in fact, a show stopper.  The user can still have
secure sources, and people who care will put pressure on the
maintainers of the unofficial sources to secure them.  Thats what
they've been doing to us :)

> See above; they have no particular incentive to become secure unless apt
> places roadblocks in front of untrusted packages, 

Or in front of untrusted sources :)

> and if it does that without being able to differentiate accurately,
> it leads to a dangerous false sense of security.

We can definitely get around that.  My suggestion would be that in
this release (if you feel that we don't have time to change dpkg to
allow your interface), we:

* default to allowing insecure sources unless the user passes a flag
to disallow it, and

* sometime soon, we default to disallowing insecure sources unless the
user passes a flag to allow it.

Both flags will be available in the first release.  This should keep
everyone happy.  People who want only secure sources can have real
security (by passing the flag), the default behavior won't change for
the first release, which gives users time to update any scripts, and
the plan to change the default will give source administrators time
(and insentive!) to update their sources before they become broken.

I would even be a fan of defaulting to disallow insecure sources in
this release by default, but I suspect that would piss people off.

peace,

isaac