Date: Sun, 26 Aug 2012 14:26:50 +0200 From: Jilles Tjoelker <jilles@stack.nl> To: CyberLeo Kitsana <cyberleo@cyberleo.net> Cc: ports@FreeBSD.org, Steve Wills <swills@FreeBSD.org>, Baptiste Daroussin <bapt@FreeBSD.org>, Doug Barton <dougb@FreeBSD.org>, current@FreeBSD.org Subject: Re: pkgng suggestion: renaming /usr/sbin/pkg to /usr/sbin/pkg-bootstrap Message-ID: <20120826122649.GA8995@stack.nl> In-Reply-To: <50396113.3080607@cyberleo.net> References: <97612B57-1255-4BB3-A6D3-FC74324C6D67@FreeBSD.org> <20120824081543.GB2998@ithaqua.etoilebsd.net> <50380269.6020003@FreeBSD.org> <20120825000148.GF37867@ithaqua.etoilebsd.net> <50396113.3080607@cyberleo.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Aug 25, 2012 at 06:34:43PM -0500, CyberLeo Kitsana wrote: > On 08/24/2012 07:01 PM, Baptiste Daroussin wrote: > > Can anyone give me he details on the security related problem? > Off the top of my head, it seems to represent a break in the chain of > trust: how does the bootstrapper verify that the tarball it just > downloaded to bootstrap pkg is genuine, and not, for example, a > trojan? The source in usr.sbin/pkg/pkg.c[1] doesn't seem to suggest it > cares. Indeed it does not care, and the current security features are insufficient (unless the bootstrapper can use the signed sqlite db to verify the pkg package). I think the fix is to modify 'pkg repo' so it detects the pkg package and creates a separate signature for it which can be verified by the bootstrapper, without needing sqlite. The public key for this signature will have to be distributed with base (like the public keys for freebsd-update and portsnap). -- Jilles Tjoelker
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20120826122649.GA8995>