From owner-freebsd-questions@FreeBSD.ORG Tue Feb 11 07:26:20 2014 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id D02C8C43 for ; Tue, 11 Feb 2014 07:26:20 +0000 (UTC) Received: from mail-pd0-f182.google.com (mail-pd0-f182.google.com [209.85.192.182]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id A49E710E7 for ; Tue, 11 Feb 2014 07:26:20 +0000 (UTC) Received: by mail-pd0-f182.google.com with SMTP id v10so7224828pde.27 for ; Mon, 10 Feb 2014 23:26:14 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :content-type; bh=KJqFYUp054BHZIOmZlj/tVPZoDZXRU5ITH6ikx5hWCs=; b=gFfFZAcn0M+aoU5xGWC9aSHLHPAfn8QvC1aoYce8z+rRK0eUfZdwJNJ2W/IaEdFUjI CplwwMWSd28yLVgD6DJp0zg8VRIiMLcUwUM8DTsi9HOTx1RFZtPSG+zUoSC/XdYB8Vz4 skWsI9DVwt3oZ6KSwWvoRXs2SBuquMNw2493yyudbyio6JpX0/YWdZQ0eJkXE1dF9/4o GcQXX7eCZktISHXyHtBsIch4RFNZyCr1KbAPLShJc3uXRLZcu6jkRb4Bpj8zlgIOsXdo JvGCQZoSFP2hGm/GFQMRUsiWPw4PP5zX9DC777fAlAl5v+3EF3Hd0pGyULbKszysIS5l PFTQ== X-Gm-Message-State: ALoCoQmvEYzUwORjPA5aGQRlesEkOAaa/WRyeqDxmo1ElN89P4JA+CAAS1Im1nL/lnPsWjF+VGzQ MIME-Version: 1.0 X-Received: by 10.66.27.72 with SMTP id r8mr30530473pag.62.1392103569177; Mon, 10 Feb 2014 23:26:09 -0800 (PST) Received: by 10.68.152.3 with HTTP; Mon, 10 Feb 2014 23:26:09 -0800 (PST) X-Originating-IP: [93.221.174.123] Date: Tue, 11 Feb 2014 08:26:09 +0100 Message-ID: Subject: Verifying a subversion checkout From: "C. P. Ghost" To: FreeBSD Mailing List Content-Type: text/plain; charset=ISO-8859-1 X-Content-Filtered-By: Mailman/MimeDel 2.1.17 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Feb 2014 07:26:21 -0000 Hello, is there a way to automatically verify that the checkout of a random subversion revision of /usr/src hasn't been tampered with? I'm worried about the possibility of 1/ an MitM attack while fetching the sources 2/ changes to the local /usr/src for whatever reasons 2/ isn't so critical; there's always the possibility to check them from another machine, provided checksums were created immediately after the svn update. It's 1/ that's bothering me. Or, asked differently, does SVN protocol support some kind of authentication that thwarts man-in-the-middle attacks? Of course, at release points, we always have checksums for the ISO images. That's security-wise the only point where I'm sure that I'm running from genuine sources. It's what's in-between releases that I'm asking about. Thanks, -cpghost. -- Cordula's Web. http://www.cordula.ws/