From owner-freebsd-ports  Tue Jan  2  7:33:56 2001
From owner-freebsd-ports@FreeBSD.ORG  Tue Jan  2 07:33:52 2001
Return-Path: <owner-freebsd-ports@FreeBSD.ORG>
Delivered-To: freebsd-ports@freebsd.org
Received: from gvr.gvr.org (gvr.gvr.org [194.151.74.97])
	by hub.freebsd.org (Postfix) with ESMTP
	id 7C6F037B402; Tue,  2 Jan 2001 07:33:51 -0800 (PST)
Received: by gvr.gvr.org (Postfix, from userid 657)
	id 08AAB5848; Tue,  2 Jan 2001 16:33:50 +0100 (CET)
Date: Tue, 2 Jan 2001 16:33:50 +0100
From: Guido van Rooij <guido@gvr.org>
To: Kris Kennaway <kris@FreeBSD.ORG>
Cc: Wes Peters <wes@softweyr.com>,
	Mario Sergio Fujikawa Ferreira <lioux@uol.com.br>,
	"Michael C . Wu" <keichii@peorth.iteration.net>, ports@FreeBSD.ORG,
	security-officer@FreeBSD.ORG
Subject: Re: Package signing tools
Message-ID: <20010102163349.A18885@gvr.gvr.org>
References: <3A4ED1C0.14061CE5@softweyr.com> <20001231003920.A24519@peorth.iteration.net> <3A4EDCA9.5CEA7114@softweyr.com> <20010101083459.B12422@citusc.usc.edu> <20010101143803.A3416@Fedaykin.here> <3A50C6A8.3E02FAE@softweyr.com> <20010101161001.B3416@Fedaykin.here> <3A50D2B7.5AD86D9E@softweyr.com> <20010102050351.C18277@citusc.usc.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20010102050351.C18277@citusc.usc.edu>; from kris@FreeBSD.ORG on Tue, Jan 02, 2001 at 05:03:51AM -0800
Sender: owner-freebsd-ports@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

On Tue, Jan 02, 2001 at 05:03:51AM -0800, Kris Kennaway wrote:
> 
> We need to think about how this is going to be used by the project,
> too. Packages are built automatically, so they'd need to be signed
> automatically. That puts the signing machine(s) in a (more) dangerous

Not necessarily. Though if done after the building phase, there is
a race that someone breaks into the machine and changes packages
before they are signed. But such a race alwaysn exists..

But then again...what exactly does the signing do. IMO signing means
that the package originated from the FreeBSD project and was not altered
after release.

-Guido


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports" in the body of the message