[jira] [Commented] (MNG-5814) Be able to verify the pgp signature of downloaded plugins

["Karl Heinz Marbaise (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/MNG-5814?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14995671#comment-14995671 ] 

Karl Heinz Marbaise commented on MNG-5814:
------------------------------------------

First using an insecure channel i would suggest to use https for accesses to Maven central or other repositories...This will of course not make it impossible to fake something..

As you described you missed a point. If you download an artifact and check its pgpg signatur it does not mean it's the same as you requested from your pom file...which means the same way for plugins...

So the problem really reduces to the point how to define a identity of an artifact (no matter if a plugin or a dependency)...

In the end you need to add some kind of information to your build to uniquely identify an artifact. So there are two options. 

 * Change the pom format (will be possible in Maven 4.X)
 * Add the information to an external file and check it somehow (could be done now)...


> Be able to verify the pgp signature of downloaded plugins
> ---------------------------------------------------------
>
>                 Key: MNG-5814
>                 URL: https://issues.apache.org/jira/browse/MNG-5814
>             Project: Maven
>          Issue Type: Improvement
>          Components: Plugin Requests
>            Reporter: Alexander Kjäll
>              Labels: security
>
> In order to protect ourself against an attacker that can do injection attacks on our downloads we need to verify the pgp signatures of the downloaded artifacts.
> For normal dependencies this can be done with a plugin, for example this one: https://github.com/s4u/pgpverify-maven-plugin/
> But it's not possible for a plugin to verify it's own authenticity, as it was downloaded over an possible insecure channel itself.
> Therefor we need something preinstalled that verifies that the plugin we downloaded is the same one that was specified in our pom file.
> I propose that functionality is added to maven that verifies the jar and pom files against it's pgp signature files for plugins. And some sort of notation is added to the pom file so that it's possible to specify the signing key for a plugin. 



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)