From owner-freebsd-hackers@freebsd.org Fri Sep 20 21:00:36 2019 Return-Path: Delivered-To: freebsd-hackers@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id CD322127027; Fri, 20 Sep 2019 21:00:36 +0000 (UTC) (envelope-from grarpamp@gmail.com) Received: from mail-io1-xd43.google.com (mail-io1-xd43.google.com [IPv6:2607:f8b0:4864:20::d43]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 46ZmMR62Wyz4ctB; Fri, 20 Sep 2019 21:00:35 +0000 (UTC) (envelope-from grarpamp@gmail.com) Received: by mail-io1-xd43.google.com with SMTP id v2so19193688iob.10; Fri, 20 Sep 2019 14:00:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=ABHAaOdC0ZGtWKBW0F8L2MVhuSDFYtQmUjNQDZ63w6Y=; b=h+jp59duGEV8CIiml2T88WcViB1lY2MBU6rmKCzkRAJUCWGHd94GzU/tfkarG4Avd5 FbxUth6p3lWCc7I8ZQ/ENXFR5Rv/MqxbZC+UzWOx9zKzm5xr8dNVXBZxUPikf8ln6jaM kdQQQHi9S8/tPSsPCWzdqazRiXTOQ9ts3GQ53wU8/mgIA2PJBQcQZzZpIGtOLEff1USq S+dk+b5nxzuqzpbLaCcP/PdxLU+F7Gd01P81l1sezvF6OHRQM2T/zgttdtSJPDDh7/L3 UDVO1IFZ+M1s7351+ZVvabOcnxykOowC3vk/BedO3IG71fEKCgpXYSsC/2MmGvfm4RWU BZMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=ABHAaOdC0ZGtWKBW0F8L2MVhuSDFYtQmUjNQDZ63w6Y=; b=qTHU55iEkB0JFT4J6q9znt5BBULaJvYVTNk1VHREa4+zOVREEW3V1eQ2ytFq6NLMIH 6DdjTkfwUcVfE5Rwci0IoFVnXfiyVdVW8tTNuCoKHYIS1+2APqnzzH1/Zo9vgcuOEDWT riyoRC8s8KQ6hIxk4KGEK5b14C7jia7Az1URjKz/BUMmCC8Hu7dgAlji/jBCMiLRXyw5 xc05eU1weCJRWANCLks+5pz9F++135ja+pDS79k7wtFTJmhnBki/coEtAQHpRSwr4zUb pW+dRDKSFxJy1JcFhLNaf24Z8dEAxb/bn7WSWjCVAma9rdMIFqPdfX3kg1NPdPfT316A uWRg== X-Gm-Message-State: APjAAAWT3jJpoM57rz3mmK8RhzC5svI0TOaLN6qlVUGYxiZhq6eHiz0R lezk7bIrhq037A1RmghgBvM3EqivbnRr6VZ+lPGTwD/5 X-Google-Smtp-Source: APXvYqz/B5GqQGRtwrdZ5vcR68PDQtziGXF4xwiEo8Bh0bkNvFHYavpM/xW5mxCnFCmlls1QG3XCMj/JB343wQymdoU= X-Received: by 2002:a5d:97cf:: with SMTP id k15mr7239670ios.151.1569013234151; Fri, 20 Sep 2019 14:00:34 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a02:9f01:0:0:0:0:0 with HTTP; Fri, 20 Sep 2019 14:00:33 -0700 (PDT) In-Reply-To: References: From: grarpamp Date: Fri, 20 Sep 2019 17:00:33 -0400 Message-ID: Subject: Re: Git/Mtn for FreeBSD, PGP WoT Sigs, Merkel Hash Tree Based To: freebsd-security@freebsd.org Cc: freebsd-questions@freebsd.org, freebsd-hackers@freebsd.org Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 46ZmMR62Wyz4ctB X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20161025 header.b=h+jp59du; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (mx1.freebsd.org: domain of grarpamp@gmail.com designates 2607:f8b0:4864:20::d43 as permitted sender) smtp.mailfrom=grarpamp@gmail.com X-Spamd-Result: default: False [-3.00 / 15.00]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20161025]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36:c]; FREEMAIL_FROM(0.00)[gmail.com]; MIME_GOOD(-0.10)[text/plain]; TO_DN_NONE(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; IP_SCORE_FREEMAIL(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; IP_SCORE(0.00)[ip: (2.09), ipnet: 2607:f8b0::/32(-2.65), asn: 15169(-2.20), country: US(-0.05)]; DKIM_TRACE(0.00)[gmail.com:+]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; RCVD_IN_DNSWL_NONE(0.00)[3.4.d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.4.6.8.4.0.b.8.f.7.0.6.2.list.dnswl.org : 127.0.5.0]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; FREEMAIL_ENVFROM(0.00)[gmail.com]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[]; DWL_DNSWL_NONE(0.00)[gmail.com.dwl.dnswl.org : 127.0.5.0] X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Sep 2019 21:00:36 -0000 For consideration... SVN really may not offer much in the way of native internal self authenticating repo to cryptographic levels of security against bitrot, transit corruption and repo ops, external physical editing, have much signing options, etc. Similar to blockchain and ZFS hash merkle-ization, signing the repo init and later points tags commits, along with full verification toolset, is useful function. https://www.monotone.ca/ https://en.wikipedia.org/wiki/Monotone_(software) https://git-scm.com/ https://en.wikipedia.org/wiki/Git Maintaining the kernel's web of trust https://lwn.net/Articles/798230/ Distributing kernel developer PGP keys via pgpkeys.git https://lkml.org/lkml/2019/8/30/597 Signing patch flow https://lwn.net/Articles/737093/ Compromised security happens https://lwn.net/Articles/464233/ https://security.stackexchange.com/questions/67920/how-safe-are-signed-git-= tags-only-as-safe-as-sha-1-or-somehow-safer https://stackoverflow.com/questions/28792784/why-does-git-use-a-cryptograph= ic-hash-function http://fossil-scm.org/index.html/doc/trunk/www/hashpolicy.wiki https://ericsink.com/vcbe/html/cryptographic_hashes.html https://svn.haxx.se/dev/archive-2015-06/0052.shtml http://git.661346.n2.nabble.com/Verifying-the-whole-repository-td1368311.ht= ml https://shattered.io/ https://www.youtube.com/watch?v=3DG8wQ88d85s4 https://en.wikipedia.org/wiki/Data_degradation https://git-scm.com/docs/git-fsck https://marc.info/?l=3Dgit&m=3D118143549107708 https://en.wikipedia.org/wiki/Comparison_of_version-control_software https://en.wikipedia.org/wiki/Deterministic_compilation https://www.monotone.ca/monotone.html#Trust-Evaluation-Hooks How does one know their entire copy of repo obtained on DVD, "mirror", or elsewhere cryptographically matches the authoritative repo... that any commits were actually signed off on... or that any reproducible builds are even reproducing the main repo... etc... cannot be done without secure crypto infrastructure at the very core. "User also knows that even if someone should break into the shared hosting server and tamper with the database, they won=E2=80=99t be able to inject malicious code into the project, because all revisions are signed by the team members, and he has set his Trust Evaluation Hooks so he doesn=E2=80=99t trust the server key for signing revisions. In monotone, the important trust consideration is on the signed content, rather than on the replication path by which that content arrived in your database." Note also CVS, which some BSD's still use (ahem: Open, Net), is even worse than SVN with zero protection at all in any component regarding this subject. It really time to migrate repo tech to year 2020.