Date: Wed, 29 Jun 2016 21:59:44 +0000 From: Glen Barber <gjb@FreeBSD.org> To: Yuri <yuri@rawbw.com> Cc: freebsd-pkgbase@FreeBSD.org Subject: Re: Are signatures of system images verified? Message-ID: <20160629215944.GJ1453@FreeBSD.org> In-Reply-To: <5f72274d-6932-fbf2-8abd-86a865aec0d1@rawbw.com> References: <2cde3a9e-8b4d-8c5e-408a-053710986e29@rawbw.com> <20160629213252.GI1453@FreeBSD.org> <5f72274d-6932-fbf2-8abd-86a865aec0d1@rawbw.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--bgQAstJ9X1Eg13Dy
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Wed, Jun 29, 2016 at 02:46:26PM -0700, Yuri wrote:
> On 06/29/2016 14:32, Glen Barber wrote:
> >But you raise a good point, poudriere does not have a good way to
> >validate the base.txz unless it also unpacks bootonly.iso (or any of the
> >installer media) and compares the checksums.
>=20
>=20
> The possible solution is that poudriere should supply a public key as a p=
art
> of the package, and all binaries that it downloads are also signed with t=
he
> corresponding private key.
>=20
If I understand what you mean correctly, that would imply poudriere is
responsible for the contents of base.txz, which it is not. I think the
better solution (if I understood correctly) is RE needs to PGP-sign the
releases/${TARGET}/${TARGET_ARCH}/X.Y-RELEASE/MANIFEST file, and include
it in the announcement email for the release, as well as on the website.
Please correct me if I did misunderstand.
This way, poudriere could verify the hash of the file against what it
has downloaded, in addition to verifying the PGP fingerprint.
Glen
--bgQAstJ9X1Eg13Dy
Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJXdETQAAoJEAMUWKVHj+KTBvcP/1zXcb3I/WeZf7fBdYGomnX7
ydjW2Rbp5CkH/8KZgo4aCs6FgyPammrM5ZMByZH4hKbJtTPxiwCTYvVhCckG7FNk
TqLiWsAz2dIaBF+Qmka1K1ceWgitwJg1WUWsQAQkFlpqrWVFO7xoVkZbd4Qn6EEH
8CyEN6rTvG4RVNFnPz/Y/wE09evMI6DKR7EXwIKVo+cEgQS4Bs0kr5zFuL+9G68d
ASl4ls2MbUKPpXkZT72JpdEGaifmWC+O6e9S5vVYJUz7jUkrOr+igO5lcVpnh3AJ
3RwmrGAb2c9HZRzPNt31vsTEf2wRejoJ6hfeoAOU8+0Xmo7G/VsQFGrS7K216LRn
DQXZGbPgNvWt4Qmw6obSo7iBk+g3Cd8h98H3JgK89dd8MKTSW0jt9VOXI5LfDtYK
b1NMZJEiQv54Y/jTL+T2bFTNfS0+RcDtRnuqc75ClEOXz5Hihs49tfJLPFF4LaqL
tZv0XYOLDBP9pc1zQUPjtuH48OrwA+7GgiAe6vBrWeibE+XT4N+b3Eofo2J2pChg
Ndr22+C8CRcqseJBpPxWo4HL3gH42La4UgFhxhniucZ8PjH1U/1rnPCi6jM1kpRF
WmItOC5DRei5Fb8BHQT0Ki+VdD9aS+I39Hpa2akoXOha/fM8S34VC05nC+l+CExk
/DEVPrC8ff0YQThUVAvx
=/5m8
-----END PGP SIGNATURE-----
--bgQAstJ9X1Eg13Dy--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20160629215944.GJ1453>