From owner-freebsd-security@freebsd.org Mon Sep 16 23:02:29 2019 Return-Path: Delivered-To: freebsd-security@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 1531CEF10D; Mon, 16 Sep 2019 23:02:29 +0000 (UTC) (envelope-from grarpamp@gmail.com) Received: from mail-io1-xd42.google.com (mail-io1-xd42.google.com [IPv6:2607:f8b0:4864:20::d42]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 46XMFw1vLlz4GY1; Mon, 16 Sep 2019 23:02:28 +0000 (UTC) (envelope-from grarpamp@gmail.com) Received: by mail-io1-xd42.google.com with SMTP id f12so2918382iog.12; Mon, 16 Sep 2019 16:02:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc :content-transfer-encoding; bh=ABHAaOdC0ZGtWKBW0F8L2MVhuSDFYtQmUjNQDZ63w6Y=; b=YxekkMpkesfeLSLZfVTtB2R65wPtzY5sKkzpFmODv45ZXnQ7AINCK2yTswOrdKJZEy 1mh64p550EOMqB4AVaoW8I++XB4q3cZ8XtVb1Nhs1OHSux9pDYx+3ldGp5iQ5ZWxIYld //WvthA6nV0ZLnb3n61KoPzu+S+qr/OqANieTtGPsOycyGR6i45RMiitrINsHGlT5Cxc FAL3vW4Oi/2045EbPoEZoPd3J5fV4J45IQW/M5vNlnGVkH4owE9dq1aX0G1/vjaQQbbM s2iExCKaA7JExv4t9Z9xU5hrlgrfGIyVBTEzg4tdY+t7XpUAYO3AOuDXRyAFneTXTYGo Bs1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc :content-transfer-encoding; bh=ABHAaOdC0ZGtWKBW0F8L2MVhuSDFYtQmUjNQDZ63w6Y=; b=r366W8occ62dfxNfjgD+c2cGuPUowP5UeL/COigfmQ6O6G+pCqPU7435PJum2WvoQM eJX9hIOUe/2539KUPbGGt0jwfiwEkFXaZkD4pQOlkIPGDCDaj/iqTTxZNR6AxkiZImHo X2BT4jWAtFMtpAmLeNfjaE3NwwmRPx7cLHUaljKmprGt8SRwbI3x/e5fU/u/loGYfUTQ Mp1asFDc9Zqg4q8th9fkdYXBxMIEljGmStOcMCdN4Gzy8BrUZlyURDTwYiOXu0tw69sq WthDCmhWLN0ASNg43Mf7D23llLKpnlhI7PGsA6rkUK3/yTVTaWuOuYZnHGLkn5RRj2BS AKdA== X-Gm-Message-State: APjAAAXNJIaSa8HFwi61VNJgF/lGfJbB4l9jwjC7eACqWGh8RfudLUY7 FG2GVEjacZgu4yxIawTJqi8TatfcHVfMnWu3xBHRjoJm X-Google-Smtp-Source: APXvYqzeBiEO3CvRLg8+qKXHJpkgUZdiix/TyECxE6bjxyooUQ6lflFiaw4q+oWoTuUTedorhbQ48caEGeQkUmJTEdw= X-Received: by 2002:a5d:97cf:: with SMTP id k15mr302746ios.151.1568674946952; Mon, 16 Sep 2019 16:02:26 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a02:9f01:0:0:0:0:0 with HTTP; Mon, 16 Sep 2019 16:02:26 -0700 (PDT) From: grarpamp Message-ID: Subject: Git/Mtn for FreeBSD, PGP WoT Sigs, Merkel Hash Tree Based To: freebsd-security@freebsd.org Cc: freebsd-questions@freebsd.org, freebsd-hackers@freebsd.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: 46XMFw1vLlz4GY1 X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20161025 header.b=YxekkMpk; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (mx1.freebsd.org: domain of grarpamp@gmail.com designates 2607:f8b0:4864:20::d42 as permitted sender) smtp.mailfrom=grarpamp@gmail.com X-Spamd-Result: default: False [-3.00 / 15.00]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20161025]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36]; FREEMAIL_FROM(0.00)[gmail.com]; MIME_GOOD(-0.10)[text/plain]; TO_DN_NONE(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; IP_SCORE_FREEMAIL(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; IP_SCORE(0.00)[ip: (2.20), ipnet: 2607:f8b0::/32(-2.69), asn: 15169(-2.24), country: US(-0.05)]; DKIM_TRACE(0.00)[gmail.com:+]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; RCVD_IN_DNSWL_NONE(0.00)[2.4.d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.4.6.8.4.0.b.8.f.7.0.6.2.list.dnswl.org : 127.0.5.0]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; FREEMAIL_ENVFROM(0.00)[gmail.com]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[]; DWL_DNSWL_NONE(0.00)[gmail.com.dwl.dnswl.org : 127.0.5.0] X-Mailman-Approved-At: Sat, 12 Oct 2019 23:27:58 +0000 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Date: Mon, 16 Sep 2019 23:02:29 -0000 X-Original-Date: Mon, 16 Sep 2019 19:02:26 -0400 X-List-Received-Date: Mon, 16 Sep 2019 23:02:29 -0000 For consideration... SVN really may not offer much in the way of native internal self authenticating repo to cryptographic levels of security against bitrot, transit corruption and repo ops, external physical editing, have much signing options, etc. Similar to blockchain and ZFS hash merkle-ization, signing the repo init and later points tags commits, along with full verification toolset, is useful function. https://www.monotone.ca/ https://en.wikipedia.org/wiki/Monotone_(software) https://git-scm.com/ https://en.wikipedia.org/wiki/Git Maintaining the kernel's web of trust https://lwn.net/Articles/798230/ Distributing kernel developer PGP keys via pgpkeys.git https://lkml.org/lkml/2019/8/30/597 Signing patch flow https://lwn.net/Articles/737093/ Compromised security happens https://lwn.net/Articles/464233/ https://security.stackexchange.com/questions/67920/how-safe-are-signed-git-= tags-only-as-safe-as-sha-1-or-somehow-safer https://stackoverflow.com/questions/28792784/why-does-git-use-a-cryptograph= ic-hash-function http://fossil-scm.org/index.html/doc/trunk/www/hashpolicy.wiki https://ericsink.com/vcbe/html/cryptographic_hashes.html https://svn.haxx.se/dev/archive-2015-06/0052.shtml http://git.661346.n2.nabble.com/Verifying-the-whole-repository-td1368311.ht= ml https://shattered.io/ https://www.youtube.com/watch?v=3DG8wQ88d85s4 https://en.wikipedia.org/wiki/Data_degradation https://git-scm.com/docs/git-fsck https://marc.info/?l=3Dgit&m=3D118143549107708 https://en.wikipedia.org/wiki/Comparison_of_version-control_software https://en.wikipedia.org/wiki/Deterministic_compilation https://www.monotone.ca/monotone.html#Trust-Evaluation-Hooks How does one know their entire copy of repo obtained on DVD, "mirror", or elsewhere cryptographically matches the authoritative repo... that any commits were actually signed off on... or that any reproducible builds are even reproducing the main repo... etc... cannot be done without secure crypto infrastructure at the very core. "User also knows that even if someone should break into the shared hosting server and tamper with the database, they won=E2=80=99t be able to inject malicious code into the project, because all revisions are signed by the team members, and he has set his Trust Evaluation Hooks so he doesn=E2=80=99t trust the server key for signing revisions. In monotone, the important trust consideration is on the signed content, rather than on the replication path by which that content arrived in your database." Note also CVS, which some BSD's still use (ahem: Open, Net), is even worse than SVN with zero protection at all in any component regarding this subject. It really time to migrate repo tech to year 2020.