Date: Wed, 12 Feb 2020 15:22:21 +0000 From: Glen Barber <gjb@freebsd.org> To: Nathan Dorfman <ndorf@rtfm.net> Cc: freebsd-security@freebsd.org Subject: Re: Cryptographic signatures of installer sets Message-ID: <20200212152221.GE9584@FreeBSD.org> In-Reply-To: <20200211233132.GA7@rtfm.net> References: <20200125200007.GA11@rtfm.net> <20200127164201.GB9584@FreeBSD.org> <20200130005006.GA13@e398a4ce8009> <20200130132239.GG9584@FreeBSD.org> <20200201233420.GA18@rtfm.net> <20200203135710.GK9584@FreeBSD.org> <20200211233132.GA7@rtfm.net>
next in thread | previous in thread | raw e-mail | index | archive | help
--lMoHOBn3xgW8/zmj Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Feb 11, 2020 at 11:31:32PM +0000, Nathan Dorfman wrote: > > The patch I have at the moment looks for the MANIFEST (rather, the > > <arch>-<target_arch>-<X.Y-RELEASE>) file in the location they are > > installed by the misc/freebsd-release-manifests package. >=20 > This seems reasonable, but I think the checksum script is also used by > the system installer (not just the jail setup script). >=20 No, they are two different sets of functionality. The system installer *always* uses the MANIFEST from the installation medium, but when fixing that, I did not notice the jail subcommand, nor that it fetches a remote MANIFEST file. > Have you considered the possibility of simply publishing a detached > signature with every MANIFEST, in a similar manner to what is done for > the installer images? >=20 I have not, as a change to the misc/freebsd-release-manifests port will generate an email (or at minimum, a change in the repository), which would be a red flag for nefarious behavior. Glen --lMoHOBn3xgW8/zmj Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEjRJAPC5sqwhs9k2jAxRYpUeP4pMFAl5EGCgACgkQAxRYpUeP 4pOlNBAAjvIackfZoFS5AtxHOnbherpNzQ92rAPXzzlz0tOagg1e4PjXz8R0ug4J egAerB2EAmfhuyTQ0ssZeECinzJuL26OUn56B0RoKw2tw/2Oo7zRZDybR7DQ6RYS mDlq6M0XZgB4Y106Ao5N9zkrpqWXLJTM0TlAuk3Qj/usi10XjC+phTP7fwi2IZdO 7eB43EQkmZwqZnPuYvoDxHtac5NYLFFU7MGnbu98Umes+uNSNWmAlzWFQXPbPQja UuQ0o4OAekqHO+RoWJDbwXhmAPE3bgX0LQOYjHFdRRjcXbZAKEkA5n87666LxXC0 XSmdPaoRSCMhrfm+F9RG4Wy4RVCKf5+tkuFTKbXE4ELUWIuXI2orN8BbshG7UYMY DElVlmyZPKNhpHbpFGFGy55ICyWrd57Ji1q4Xx0v3b1xlcm7Xmt/OXOMalxrRqxn nNMAdhxjza3tIgQF04FOs5QPgdFd23OGHDZQJiQ4Q/Iz2d9y84pqYKzfotmi2ZNP aqpUX8ajk/X8hg4E/4bHpZKaWz/wa1Kb6ppccj841DViCe6TrEJlNVA5ra5bDp0i ZXn+sIINeK3CuTZJAMW5ASNofeVI9a9iLO/MSRxvkoO4ZXivaE7YKBGgWPMpJTaT /9j7j1/hZS++dMgbwLsJLg8LVTXtu+uRcb2QCHlovikV6hREpRQ= =8nBS -----END PGP SIGNATURE----- --lMoHOBn3xgW8/zmj--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20200212152221.GE9584>