From owner-freebsd-security Mon Jan 13 7:41:15 2003 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 164BD37B401; Mon, 13 Jan 2003 07:41:13 -0800 (PST) Received: from gunjin.wccnet.org (gunjin.wccnet.org [198.111.176.99]) by mx1.FreeBSD.org (Postfix) with ESMTP id 56D1A43E4A; Mon, 13 Jan 2003 07:41:12 -0800 (PST) (envelope-from anthony@gunjin.wccnet.org) Received: from gunjin.wccnet.org (localhost.rexroof.com [127.0.0.1]) by gunjin.wccnet.org (8.12.3/8.12.2) with ESMTP id h0DFq9go020424; Mon, 13 Jan 2003 10:52:09 -0500 (EST) Received: (from anthony@localhost) by gunjin.wccnet.org (8.12.3/8.12.3/Submit) id h0DFq868020423; Mon, 13 Jan 2003 10:52:08 -0500 (EST) Date: Mon, 13 Jan 2003 10:52:08 -0500 From: Anthony Schneider To: "Jacques A. Vidrine" Cc: "Nathan J. Yoder" , freebsd-security@FreeBSD.ORG Subject: Re: digital signatures for downloads Message-ID: <20030113155208.GA20328@x-anthony.com> References: <6121584208.20030113005107@gummibears.nu> <20030113145330.GA78337@madman.nectar.cc> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030113145330.GA78337@madman.nectar.cc> User-Agent: Mutt/1.4i Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org i think his point might be that there is only a link provided, and not the hash itself, in the advisory. of course, it's a signature and not just an md5 hash, so i don't see it as a big problem. -Anthony. On Mon, Jan 13, 2003 at 08:53:30AM -0600, Jacques A. Vidrine wrote: > On Mon, Jan 13, 2003 at 12:51:07AM -0500, Nathan J. Yoder wrote: > > While the FreeBSD security advisories are signed, they > > don't include secure hashes of the patches, rather they just provide > > an insecure FTP link. > > Patches are also signed. For example, from the latest advisory: > > `` > a) Download the relevant patch from the location below, and verify the > detached PGP signature using your PGP utility. > > # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch > # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-02:44/filedesc.patch.asc > '' > > The `.asc' file is the detached signature. > > > But I agree that packages, et cetera should also be signed. > Many of the tools are already there, but we have processes to work on. > > Cheers, > -- > Jacques A. Vidrine http://www.celabo.org/ > NTT/Verio SME . FreeBSD UNIX . Heimdal Kerberos > jvidrine@verio.net . nectar@FreeBSD.org . nectar@kth.se > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message