way for an sa-update channel to specify that GPG keys are required

[Justin Mason <jm...@jmason.org>]

So, on this issue -- a good way to do this would be to use the MIRRORED.BY
file.   Right now, any lines that don't start with "http:" are ignored, so
we could add something like

    gpg-signed 4598349584 http://url/of/GPG.KEYS

ie. a keyid that must be present on the files for the update to be valid,
and an URL that that keyid's public key can be found if it isn't already
on the keyring.

If that line is in MIRRORED.BY, and the update isn't signed by that key,
or that key isn't on the caller's keyring, the update fails and the
URL is output.

--j.

Re: way for an sa-update channel to specify that GPG keys are required

[Theo Van Dinter <fe...@apache.org>]

On Wed, Dec 21, 2005 at 09:33:23PM -0800, Justin Mason wrote:
> > >     gpg-signed 4598349584 http://url/of/GPG.KEYS
> 
> I forgot to mention ;) -- but this would be incremental.  The keyid in
> question would have to be already listed in sa-update, or on the
> commandline, therefore the hijacker would have to hijack those methods
> *too*.

I don't think this is a useful feature.  First, the key already has to
be listed.  Second, we don't want to randomly download and import a key
from an URL in a random file.  Third, I really don't like the idea that
the publisher forces the client to do things.  If the client doesn't want
to do GPG, they shouldn't be forced to use it.  I think enabling GPG by
default (which it is) gets the point across that it's highly recommended
to use it all the time.  There's no benefit in that situation to have
the channel also specify that gpg must be used.

-- 
Randomly Generated Tagline:
The trained mind does not need a watch. Watches are a confidence trick
 invented by the Swiss.  - Chiun in Remo Williams: The Saga Begins

Re: way for an sa-update channel to specify that GPG keys are required

[Theo Van Dinter <fe...@apache.org>]

On Wed, Dec 21, 2005 at 08:22:30PM -0800, Justin Mason wrote:
>     gpg-signed 4598349584 http://url/of/GPG.KEYS
> 
> ie. a keyid that must be present on the files for the update to be valid,
> and an URL that that keyid's public key can be found if it isn't already
> on the keyring.
> 
> If that line is in MIRRORED.BY, and the update isn't signed by that key,
> or that key isn't on the caller's keyring, the update fails and the
> URL is output.

If I can hijack your request for the MIRRORED.BY file, then I can 0wn
your box.  The current method requires the person running sa-update to
specify what key(s) they trust (or just accept the default/built-in keys).
Therefore, I can try hijacking any one of your connections I want,
you won't trust the file I send you.

-- 
Randomly Generated Tagline:
Don't force it, use a bigger hammer