You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@community.apache.org by Christopher <ct...@apache.org> on 2016/05/18 17:45:28 UTC
SHA512 by default for GPG sigs
Hi all,
I'm not sure a better list to get feedback on, but I wanted to bring
attention to the proposal here:
https://issues.apache.org/jira/browse/MPOM-118
Essentially this is a suggestion to configure the maven-gpg-plugin to sign
using SHA512 as its digest algorithm in the ASF Parent POM, used by many
Maven/Java-based projects within ASF. This configuration takes affect
during software releases when this plugin is activated (typically prior to
a release candidate vote, and staging a release in Nexus for distribution
to Maven Central).
This would only affect the hash algorithm used to generate GPG signatures
for releases, and not any separate SHA/MD hashes published separately by
any project, which can be weaker (SHA1, MD5) for convenience, and don't
convey the strong authenticity statement that digital signatures provide.
For background, gpg uses SHA1 by default, unless the signing key or gpg
configuration has a preference to use another algorithm (as described on
https://www.apache.org/dev/openpgp).
This proposed configuration change wouldn't force the use of SHA512 (it
could still be overridden by a project), but it would make it the default,
which helps improve the security of releases in the case where release
managers have failed to keep their configuration up-to-date with the best
recommendations for using gpg.
Thoughts? +1s? Discuss here or on the JIRA please.
Thank you.
Re: SHA512 by default for GPG sigs
Posted by Andy Seaborne <an...@apache.org>.
On 18/05/16 18:58, Greg Trasuk wrote:
>
> Hi Christopher:
>
> Thanks for your involvement. Apache Maven is one of many projects at the Apache Software Foundation. Each project has its own mailing lists. So your discussion should probably go to dev@maven.apache.org, which I\u2019ve cc\u2019d on this response. If you\u2019re not subscribed to that list, you probably should do that as well - check the Apache Maven web site (http://maven.apache.org) for more info.
>
> Thanks again,
>
> Greg Trasuk
I think Christopher is talking about the Apache POM and effect on ASF
releases for java-related projects that use org.apache:apache, rather
than maven development.
Andy
>
>> On May 18, 2016, at 1:45 PM, Christopher <ct...@apache.org> wrote:
>>
>> Hi all,
>>
>> I'm not sure a better list to get feedback on, but I wanted to bring
>> attention to the proposal here:
>> https://issues.apache.org/jira/browse/MPOM-118
>>
>> Essentially this is a suggestion to configure the maven-gpg-plugin to sign
>> using SHA512 as its digest algorithm in the ASF Parent POM, used by many
>> Maven/Java-based projects within ASF. This configuration takes affect
>> during software releases when this plugin is activated (typically prior to
>> a release candidate vote, and staging a release in Nexus for distribution
>> to Maven Central).
>>
>> This would only affect the hash algorithm used to generate GPG signatures
>> for releases, and not any separate SHA/MD hashes published separately by
>> any project, which can be weaker (SHA1, MD5) for convenience, and don't
>> convey the strong authenticity statement that digital signatures provide.
>>
>> For background, gpg uses SHA1 by default, unless the signing key or gpg
>> configuration has a preference to use another algorithm (as described on
>> https://www.apache.org/dev/openpgp).
>>
>> This proposed configuration change wouldn't force the use of SHA512 (it
>> could still be overridden by a project), but it would make it the default,
>> which helps improve the security of releases in the case where release
>> managers have failed to keep their configuration up-to-date with the best
>> recommendations for using gpg.
>>
>> Thoughts? +1s? Discuss here or on the JIRA please.
>>
>> Thank you.
>
Re: SHA512 by default for GPG sigs
Posted by Christopher <ct...@apache.org>.
Yes, that is correct. I'm referring to the ASF-wide parent pom.
If I understand the situation correctly, releases of that POM are managed
by the Maven PMC, but because of it's utility throughout the ASF, Hervé
Boutemy had commented on MPOM-118 that it should be brought to the
attention of a larger audience. This thread is the result of his
observation. :)
But there is no harm done. Thanks for providing an opportunity to clarify.
On Wed, May 18, 2016 at 3:26 PM Greg Trasuk <tr...@stratuscom.com> wrote:
> Whoops. Sorry about that.
>
> Greg
>
> > On May 18, 2016, at 2:50 PM, Benson Margulies <bi...@gmail.com>
> wrote:
> >
> > Greg, the proposal is for the _Default ASF POM_ to be set up so that
> > _all_ projects would use SHA-512. This is not a question for the Maven
> > PMC.
> >
> > On Wed, May 18, 2016 at 1:58 PM, Greg Trasuk <tr...@stratuscom.com>
> wrote:
> >>
> >> Hi Christopher:
> >>
> >> Thanks for your involvement. Apache Maven is one of many projects at
> the Apache Software Foundation. Each project has its own mailing lists.
> So your discussion should probably go to dev@maven.apache.org, which I’ve
> cc’d on this response. If you’re not subscribed to that list, you probably
> should do that as well - check the Apache Maven web site (
> http://maven.apache.org) for more info.
> >>
> >> Thanks again,
> >>
> >> Greg Trasuk
> >>
> >>> On May 18, 2016, at 1:45 PM, Christopher <ct...@apache.org> wrote:
> >>>
> >>> Hi all,
> >>>
> >>> I'm not sure a better list to get feedback on, but I wanted to bring
> >>> attention to the proposal here:
> >>> https://issues.apache.org/jira/browse/MPOM-118
> >>>
> >>> Essentially this is a suggestion to configure the maven-gpg-plugin to
> sign
> >>> using SHA512 as its digest algorithm in the ASF Parent POM, used by
> many
> >>> Maven/Java-based projects within ASF. This configuration takes affect
> >>> during software releases when this plugin is activated (typically
> prior to
> >>> a release candidate vote, and staging a release in Nexus for
> distribution
> >>> to Maven Central).
> >>>
> >>> This would only affect the hash algorithm used to generate GPG
> signatures
> >>> for releases, and not any separate SHA/MD hashes published separately
> by
> >>> any project, which can be weaker (SHA1, MD5) for convenience, and don't
> >>> convey the strong authenticity statement that digital signatures
> provide.
> >>>
> >>> For background, gpg uses SHA1 by default, unless the signing key or gpg
> >>> configuration has a preference to use another algorithm (as described
> on
> >>> https://www.apache.org/dev/openpgp).
> >>>
> >>> This proposed configuration change wouldn't force the use of SHA512 (it
> >>> could still be overridden by a project), but it would make it the
> default,
> >>> which helps improve the security of releases in the case where release
> >>> managers have failed to keep their configuration up-to-date with the
> best
> >>> recommendations for using gpg.
> >>>
> >>> Thoughts? +1s? Discuss here or on the JIRA please.
> >>>
> >>> Thank you.
> >>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> >> For additional commands, e-mail: dev-help@maven.apache.org
> >>
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > For additional commands, e-mail: dev-help@maven.apache.org
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
>
Re: SHA512 by default for GPG sigs
Posted by Christopher <ct...@apache.org>.
Yes, that is correct. I'm referring to the ASF-wide parent pom.
If I understand the situation correctly, releases of that POM are managed
by the Maven PMC, but because of it's utility throughout the ASF, Hervé
Boutemy had commented on MPOM-118 that it should be brought to the
attention of a larger audience. This thread is the result of his
observation. :)
But there is no harm done. Thanks for providing an opportunity to clarify.
On Wed, May 18, 2016 at 3:26 PM Greg Trasuk <tr...@stratuscom.com> wrote:
> Whoops. Sorry about that.
>
> Greg
>
> > On May 18, 2016, at 2:50 PM, Benson Margulies <bi...@gmail.com>
> wrote:
> >
> > Greg, the proposal is for the _Default ASF POM_ to be set up so that
> > _all_ projects would use SHA-512. This is not a question for the Maven
> > PMC.
> >
> > On Wed, May 18, 2016 at 1:58 PM, Greg Trasuk <tr...@stratuscom.com>
> wrote:
> >>
> >> Hi Christopher:
> >>
> >> Thanks for your involvement. Apache Maven is one of many projects at
> the Apache Software Foundation. Each project has its own mailing lists.
> So your discussion should probably go to dev@maven.apache.org, which I’ve
> cc’d on this response. If you’re not subscribed to that list, you probably
> should do that as well - check the Apache Maven web site (
> http://maven.apache.org) for more info.
> >>
> >> Thanks again,
> >>
> >> Greg Trasuk
> >>
> >>> On May 18, 2016, at 1:45 PM, Christopher <ct...@apache.org> wrote:
> >>>
> >>> Hi all,
> >>>
> >>> I'm not sure a better list to get feedback on, but I wanted to bring
> >>> attention to the proposal here:
> >>> https://issues.apache.org/jira/browse/MPOM-118
> >>>
> >>> Essentially this is a suggestion to configure the maven-gpg-plugin to
> sign
> >>> using SHA512 as its digest algorithm in the ASF Parent POM, used by
> many
> >>> Maven/Java-based projects within ASF. This configuration takes affect
> >>> during software releases when this plugin is activated (typically
> prior to
> >>> a release candidate vote, and staging a release in Nexus for
> distribution
> >>> to Maven Central).
> >>>
> >>> This would only affect the hash algorithm used to generate GPG
> signatures
> >>> for releases, and not any separate SHA/MD hashes published separately
> by
> >>> any project, which can be weaker (SHA1, MD5) for convenience, and don't
> >>> convey the strong authenticity statement that digital signatures
> provide.
> >>>
> >>> For background, gpg uses SHA1 by default, unless the signing key or gpg
> >>> configuration has a preference to use another algorithm (as described
> on
> >>> https://www.apache.org/dev/openpgp).
> >>>
> >>> This proposed configuration change wouldn't force the use of SHA512 (it
> >>> could still be overridden by a project), but it would make it the
> default,
> >>> which helps improve the security of releases in the case where release
> >>> managers have failed to keep their configuration up-to-date with the
> best
> >>> recommendations for using gpg.
> >>>
> >>> Thoughts? +1s? Discuss here or on the JIRA please.
> >>>
> >>> Thank you.
> >>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> >> For additional commands, e-mail: dev-help@maven.apache.org
> >>
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > For additional commands, e-mail: dev-help@maven.apache.org
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
>
Re: SHA512 by default for GPG sigs
Posted by Greg Trasuk <tr...@stratuscom.com>.
Whoops. Sorry about that.
Greg
> On May 18, 2016, at 2:50 PM, Benson Margulies <bi...@gmail.com> wrote:
>
> Greg, the proposal is for the _Default ASF POM_ to be set up so that
> _all_ projects would use SHA-512. This is not a question for the Maven
> PMC.
>
> On Wed, May 18, 2016 at 1:58 PM, Greg Trasuk <tr...@stratuscom.com> wrote:
>>
>> Hi Christopher:
>>
>> Thanks for your involvement. Apache Maven is one of many projects at the Apache Software Foundation. Each project has its own mailing lists. So your discussion should probably go to dev@maven.apache.org, which I’ve cc’d on this response. If you’re not subscribed to that list, you probably should do that as well - check the Apache Maven web site (http://maven.apache.org) for more info.
>>
>> Thanks again,
>>
>> Greg Trasuk
>>
>>> On May 18, 2016, at 1:45 PM, Christopher <ct...@apache.org> wrote:
>>>
>>> Hi all,
>>>
>>> I'm not sure a better list to get feedback on, but I wanted to bring
>>> attention to the proposal here:
>>> https://issues.apache.org/jira/browse/MPOM-118
>>>
>>> Essentially this is a suggestion to configure the maven-gpg-plugin to sign
>>> using SHA512 as its digest algorithm in the ASF Parent POM, used by many
>>> Maven/Java-based projects within ASF. This configuration takes affect
>>> during software releases when this plugin is activated (typically prior to
>>> a release candidate vote, and staging a release in Nexus for distribution
>>> to Maven Central).
>>>
>>> This would only affect the hash algorithm used to generate GPG signatures
>>> for releases, and not any separate SHA/MD hashes published separately by
>>> any project, which can be weaker (SHA1, MD5) for convenience, and don't
>>> convey the strong authenticity statement that digital signatures provide.
>>>
>>> For background, gpg uses SHA1 by default, unless the signing key or gpg
>>> configuration has a preference to use another algorithm (as described on
>>> https://www.apache.org/dev/openpgp).
>>>
>>> This proposed configuration change wouldn't force the use of SHA512 (it
>>> could still be overridden by a project), but it would make it the default,
>>> which helps improve the security of releases in the case where release
>>> managers have failed to keep their configuration up-to-date with the best
>>> recommendations for using gpg.
>>>
>>> Thoughts? +1s? Discuss here or on the JIRA please.
>>>
>>> Thank you.
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
>> For additional commands, e-mail: dev-help@maven.apache.org
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
Re: SHA512 by default for GPG sigs
Posted by Greg Trasuk <tr...@stratuscom.com>.
Whoops. Sorry about that.
Greg
> On May 18, 2016, at 2:50 PM, Benson Margulies <bi...@gmail.com> wrote:
>
> Greg, the proposal is for the _Default ASF POM_ to be set up so that
> _all_ projects would use SHA-512. This is not a question for the Maven
> PMC.
>
> On Wed, May 18, 2016 at 1:58 PM, Greg Trasuk <tr...@stratuscom.com> wrote:
>>
>> Hi Christopher:
>>
>> Thanks for your involvement. Apache Maven is one of many projects at the Apache Software Foundation. Each project has its own mailing lists. So your discussion should probably go to dev@maven.apache.org, which I’ve cc’d on this response. If you’re not subscribed to that list, you probably should do that as well - check the Apache Maven web site (http://maven.apache.org) for more info.
>>
>> Thanks again,
>>
>> Greg Trasuk
>>
>>> On May 18, 2016, at 1:45 PM, Christopher <ct...@apache.org> wrote:
>>>
>>> Hi all,
>>>
>>> I'm not sure a better list to get feedback on, but I wanted to bring
>>> attention to the proposal here:
>>> https://issues.apache.org/jira/browse/MPOM-118
>>>
>>> Essentially this is a suggestion to configure the maven-gpg-plugin to sign
>>> using SHA512 as its digest algorithm in the ASF Parent POM, used by many
>>> Maven/Java-based projects within ASF. This configuration takes affect
>>> during software releases when this plugin is activated (typically prior to
>>> a release candidate vote, and staging a release in Nexus for distribution
>>> to Maven Central).
>>>
>>> This would only affect the hash algorithm used to generate GPG signatures
>>> for releases, and not any separate SHA/MD hashes published separately by
>>> any project, which can be weaker (SHA1, MD5) for convenience, and don't
>>> convey the strong authenticity statement that digital signatures provide.
>>>
>>> For background, gpg uses SHA1 by default, unless the signing key or gpg
>>> configuration has a preference to use another algorithm (as described on
>>> https://www.apache.org/dev/openpgp).
>>>
>>> This proposed configuration change wouldn't force the use of SHA512 (it
>>> could still be overridden by a project), but it would make it the default,
>>> which helps improve the security of releases in the case where release
>>> managers have failed to keep their configuration up-to-date with the best
>>> recommendations for using gpg.
>>>
>>> Thoughts? +1s? Discuss here or on the JIRA please.
>>>
>>> Thank you.
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
>> For additional commands, e-mail: dev-help@maven.apache.org
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: SHA512 by default for GPG sigs
Posted by Benson Margulies <bi...@gmail.com>.
Greg, the proposal is for the _Default ASF POM_ to be set up so that
_all_ projects would use SHA-512. This is not a question for the Maven
PMC.
On Wed, May 18, 2016 at 1:58 PM, Greg Trasuk <tr...@stratuscom.com> wrote:
>
> Hi Christopher:
>
> Thanks for your involvement. Apache Maven is one of many projects at the Apache Software Foundation. Each project has its own mailing lists. So your discussion should probably go to dev@maven.apache.org, which I’ve cc’d on this response. If you’re not subscribed to that list, you probably should do that as well - check the Apache Maven web site (http://maven.apache.org) for more info.
>
> Thanks again,
>
> Greg Trasuk
>
>> On May 18, 2016, at 1:45 PM, Christopher <ct...@apache.org> wrote:
>>
>> Hi all,
>>
>> I'm not sure a better list to get feedback on, but I wanted to bring
>> attention to the proposal here:
>> https://issues.apache.org/jira/browse/MPOM-118
>>
>> Essentially this is a suggestion to configure the maven-gpg-plugin to sign
>> using SHA512 as its digest algorithm in the ASF Parent POM, used by many
>> Maven/Java-based projects within ASF. This configuration takes affect
>> during software releases when this plugin is activated (typically prior to
>> a release candidate vote, and staging a release in Nexus for distribution
>> to Maven Central).
>>
>> This would only affect the hash algorithm used to generate GPG signatures
>> for releases, and not any separate SHA/MD hashes published separately by
>> any project, which can be weaker (SHA1, MD5) for convenience, and don't
>> convey the strong authenticity statement that digital signatures provide.
>>
>> For background, gpg uses SHA1 by default, unless the signing key or gpg
>> configuration has a preference to use another algorithm (as described on
>> https://www.apache.org/dev/openpgp).
>>
>> This proposed configuration change wouldn't force the use of SHA512 (it
>> could still be overridden by a project), but it would make it the default,
>> which helps improve the security of releases in the case where release
>> managers have failed to keep their configuration up-to-date with the best
>> recommendations for using gpg.
>>
>> Thoughts? +1s? Discuss here or on the JIRA please.
>>
>> Thank you.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
Re: SHA512 by default for GPG sigs
Posted by Benson Margulies <bi...@gmail.com>.
Greg, the proposal is for the _Default ASF POM_ to be set up so that
_all_ projects would use SHA-512. This is not a question for the Maven
PMC.
On Wed, May 18, 2016 at 1:58 PM, Greg Trasuk <tr...@stratuscom.com> wrote:
>
> Hi Christopher:
>
> Thanks for your involvement. Apache Maven is one of many projects at the Apache Software Foundation. Each project has its own mailing lists. So your discussion should probably go to dev@maven.apache.org, which I’ve cc’d on this response. If you’re not subscribed to that list, you probably should do that as well - check the Apache Maven web site (http://maven.apache.org) for more info.
>
> Thanks again,
>
> Greg Trasuk
>
>> On May 18, 2016, at 1:45 PM, Christopher <ct...@apache.org> wrote:
>>
>> Hi all,
>>
>> I'm not sure a better list to get feedback on, but I wanted to bring
>> attention to the proposal here:
>> https://issues.apache.org/jira/browse/MPOM-118
>>
>> Essentially this is a suggestion to configure the maven-gpg-plugin to sign
>> using SHA512 as its digest algorithm in the ASF Parent POM, used by many
>> Maven/Java-based projects within ASF. This configuration takes affect
>> during software releases when this plugin is activated (typically prior to
>> a release candidate vote, and staging a release in Nexus for distribution
>> to Maven Central).
>>
>> This would only affect the hash algorithm used to generate GPG signatures
>> for releases, and not any separate SHA/MD hashes published separately by
>> any project, which can be weaker (SHA1, MD5) for convenience, and don't
>> convey the strong authenticity statement that digital signatures provide.
>>
>> For background, gpg uses SHA1 by default, unless the signing key or gpg
>> configuration has a preference to use another algorithm (as described on
>> https://www.apache.org/dev/openpgp).
>>
>> This proposed configuration change wouldn't force the use of SHA512 (it
>> could still be overridden by a project), but it would make it the default,
>> which helps improve the security of releases in the case where release
>> managers have failed to keep their configuration up-to-date with the best
>> recommendations for using gpg.
>>
>> Thoughts? +1s? Discuss here or on the JIRA please.
>>
>> Thank you.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: SHA512 by default for GPG sigs
Posted by Greg Trasuk <tr...@stratuscom.com>.
Hi Christopher:
Thanks for your involvement. Apache Maven is one of many projects at the Apache Software Foundation. Each project has its own mailing lists. So your discussion should probably go to dev@maven.apache.org, which I’ve cc’d on this response. If you’re not subscribed to that list, you probably should do that as well - check the Apache Maven web site (http://maven.apache.org) for more info.
Thanks again,
Greg Trasuk
> On May 18, 2016, at 1:45 PM, Christopher <ct...@apache.org> wrote:
>
> Hi all,
>
> I'm not sure a better list to get feedback on, but I wanted to bring
> attention to the proposal here:
> https://issues.apache.org/jira/browse/MPOM-118
>
> Essentially this is a suggestion to configure the maven-gpg-plugin to sign
> using SHA512 as its digest algorithm in the ASF Parent POM, used by many
> Maven/Java-based projects within ASF. This configuration takes affect
> during software releases when this plugin is activated (typically prior to
> a release candidate vote, and staging a release in Nexus for distribution
> to Maven Central).
>
> This would only affect the hash algorithm used to generate GPG signatures
> for releases, and not any separate SHA/MD hashes published separately by
> any project, which can be weaker (SHA1, MD5) for convenience, and don't
> convey the strong authenticity statement that digital signatures provide.
>
> For background, gpg uses SHA1 by default, unless the signing key or gpg
> configuration has a preference to use another algorithm (as described on
> https://www.apache.org/dev/openpgp).
>
> This proposed configuration change wouldn't force the use of SHA512 (it
> could still be overridden by a project), but it would make it the default,
> which helps improve the security of releases in the case where release
> managers have failed to keep their configuration up-to-date with the best
> recommendations for using gpg.
>
> Thoughts? +1s? Discuss here or on the JIRA please.
>
> Thank you.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: SHA512 by default for GPG sigs
Posted by Sergio Fernández <wi...@apache.org>.
+1
On Wed, May 18, 2016 at 7:45 PM, Christopher <ct...@apache.org> wrote:
> Hi all,
>
> I'm not sure a better list to get feedback on, but I wanted to bring
> attention to the proposal here:
> https://issues.apache.org/jira/browse/MPOM-118
>
> Essentially this is a suggestion to configure the maven-gpg-plugin to sign
> using SHA512 as its digest algorithm in the ASF Parent POM, used by many
> Maven/Java-based projects within ASF. This configuration takes affect
> during software releases when this plugin is activated (typically prior to
> a release candidate vote, and staging a release in Nexus for distribution
> to Maven Central).
>
> This would only affect the hash algorithm used to generate GPG signatures
> for releases, and not any separate SHA/MD hashes published separately by
> any project, which can be weaker (SHA1, MD5) for convenience, and don't
> convey the strong authenticity statement that digital signatures provide.
>
> For background, gpg uses SHA1 by default, unless the signing key or gpg
> configuration has a preference to use another algorithm (as described on
> https://www.apache.org/dev/openpgp).
>
> This proposed configuration change wouldn't force the use of SHA512 (it
> could still be overridden by a project), but it would make it the default,
> which helps improve the security of releases in the case where release
> managers have failed to keep their configuration up-to-date with the best
> recommendations for using gpg.
>
> Thoughts? +1s? Discuss here or on the JIRA please.
>
> Thank you.
>
--
Sergio Fernández
Partner Technology Manager
Redlink GmbH
m: +43 6602747925
e: sergio.fernandez@redlink.co
w: http://redlink.co
Re: SHA512 by default for GPG sigs
Posted by Christopher <ct...@apache.org>.
On Thu, May 19, 2016 at 2:43 AM Stian Soiland-Reyes <st...@apache.org>
wrote:
> In principle +1, a PGP signature based on sha1 is not cryptographically
> strong.
>
> Obviously blindly checking a PGP signature, even after importing the KEYS
> from https://www.apache.org/dist, that is also not any proof you got the
> intended release, just an artifact by someone who previously signed some
> ASF release. (If you are paranoid and/or work my for a three-letter
> government institution, then you probably want more proof of exactly which
> version you are downloading)
>
>
Agreed. That's why folks also are encouraged to grow their web of trust.
Frankly, though, I'm generally content with any valid signature from a key
in a PMC's managed KEYS file, at least for the purposes of verifying
releases. That's because I have a reasonable confidence in the Apache
infrastructure to secure the published KEYS files, and that the release
managers are using their keys to act in the interest of their respective
PMCs (or at least, not using them to act against it by falsifying
unofficial releases).
A GPG signature doesn't attest that "content X came from entity E". It
attests that "the content whose hash is X came from entity E". So, that
attestation is only as strong as the hash algorithm. Weaker algorithms are
subject to "pre-image" attacks (maybe still a long way off for SHA-1, but
we still should avoid it).
> I think the convenience of the old standard .sha1 and .md5 files is that
> they can also be included in this VOTE emails, forming a distributed
> evidence in list archives of which release was approved. (although I see
> many projects now being made more lax about this and just refer to a
> transient Maven step repo). In addition to being easy to check, they are
> also easy to inline say in a Dockerfile, so I would not get rid of those
> even if the .asc is improved.
>
>
Agreed. I also wouldn't get rid of those. They have their own utility. This
is just about making the *.asc detached signature files stronger.
> Are there any compatibility issues for downstream users with your proposed
> default change? What about for Maven deployment? I assume a newer gpg is
> needed; what would be the new version requirement, and how does this match
> what is available in typical distros and OS installs?
> On 18 May 2016 7:55 p.m., "Christopher" <ct...@apache.org> wrote:
>
>
It's possible, but I think very unlikely that this would cause any problems
for anybody. GnuPG added support for SHA512 in early 2003, and all the tags
in GnuPG's git repo seem to support it. Old versions of OpenPGP didn't
support it, but that's a dead project (AFAICT), and in any case, this is
the maven-gpg-plugin, not the maven-openpgp-plugin. All tags in the gnupg
git repo seem to support SHA512. Anything installed today should support
it. If there are concerning compatibility issues, then those issues would
already be a problem for the documented ASF advice at
https://www.apache.org/dev/openpgp
This doesn't affect Maven deployments at all, except to make the signatures
emitted in the release profile's activation of maven-gpg-plugin stronger.
This really should be transparent. How rare it is to get more security
without having to trade anything of value for it... but it seems to me
that's what we have in this situation.
Re: SHA512 by default for GPG sigs
Posted by Stian Soiland-Reyes <st...@apache.org>.
In principle +1, a PGP signature based on sha1 is not cryptographically
strong.
Obviously blindly checking a PGP signature, even after importing the KEYS
from https://www.apache.org/dist, that is also not any proof you got the
intended release, just an artifact by someone who previously signed some
ASF release. (If you are paranoid and/or work my for a three-letter
government institution, then you probably want more proof of exactly which
version you are downloading)
I think the convenience of the old standard .sha1 and .md5 files is that
they can also be included in this VOTE emails, forming a distributed
evidence in list archives of which release was approved. (although I see
many projects now being made more lax about this and just refer to a
transient Maven step repo). In addition to being easy to check, they are
also easy to inline say in a Dockerfile, so I would not get rid of those
even if the .asc is improved.
Are there any compatibility issues for downstream users with your proposed
default change? What about for Maven deployment? I assume a newer gpg is
needed; what would be the new version requirement, and how does this match
what is available in typical distros and OS installs?
On 18 May 2016 7:55 p.m., "Christopher" <ct...@apache.org> wrote:
> Hi all,
>
> I'm not sure a better list to get feedback on, but I wanted to bring
> attention to the proposal here:
> https://issues.apache.org/jira/browse/MPOM-118
>
> Essentially this is a suggestion to configure the maven-gpg-plugin to sign
> using SHA512 as its digest algorithm in the ASF Parent POM, used by many
> Maven/Java-based projects within ASF. This configuration takes affect
> during software releases when this plugin is activated (typically prior to
> a release candidate vote, and staging a release in Nexus for distribution
> to Maven Central).
>
> This would only affect the hash algorithm used to generate GPG signatures
> for releases, and not any separate SHA/MD hashes published separately by
> any project, which can be weaker (SHA1, MD5) for convenience, and don't
> convey the strong authenticity statement that digital signatures provide.
>
> For background, gpg uses SHA1 by default, unless the signing key or gpg
> configuration has a preference to use another algorithm (as described on
> https://www.apache.org/dev/openpgp).
>
> This proposed configuration change wouldn't force the use of SHA512 (it
> could still be overridden by a project), but it would make it the default,
> which helps improve the security of releases in the case where release
> managers have failed to keep their configuration up-to-date with the best
> recommendations for using gpg.
>
> Thoughts? +1s? Discuss here or on the JIRA please.
>
> Thank you.
>
Re: SHA512 by default for GPG sigs
Posted by Greg Trasuk <tr...@stratuscom.com>.
Hi Christopher:
Thanks for your involvement. Apache Maven is one of many projects at the Apache Software Foundation. Each project has its own mailing lists. So your discussion should probably go to dev@maven.apache.org, which I’ve cc’d on this response. If you’re not subscribed to that list, you probably should do that as well - check the Apache Maven web site (http://maven.apache.org) for more info.
Thanks again,
Greg Trasuk
> On May 18, 2016, at 1:45 PM, Christopher <ct...@apache.org> wrote:
>
> Hi all,
>
> I'm not sure a better list to get feedback on, but I wanted to bring
> attention to the proposal here:
> https://issues.apache.org/jira/browse/MPOM-118
>
> Essentially this is a suggestion to configure the maven-gpg-plugin to sign
> using SHA512 as its digest algorithm in the ASF Parent POM, used by many
> Maven/Java-based projects within ASF. This configuration takes affect
> during software releases when this plugin is activated (typically prior to
> a release candidate vote, and staging a release in Nexus for distribution
> to Maven Central).
>
> This would only affect the hash algorithm used to generate GPG signatures
> for releases, and not any separate SHA/MD hashes published separately by
> any project, which can be weaker (SHA1, MD5) for convenience, and don't
> convey the strong authenticity statement that digital signatures provide.
>
> For background, gpg uses SHA1 by default, unless the signing key or gpg
> configuration has a preference to use another algorithm (as described on
> https://www.apache.org/dev/openpgp).
>
> This proposed configuration change wouldn't force the use of SHA512 (it
> could still be overridden by a project), but it would make it the default,
> which helps improve the security of releases in the case where release
> managers have failed to keep their configuration up-to-date with the best
> recommendations for using gpg.
>
> Thoughts? +1s? Discuss here or on the JIRA please.
>
> Thank you.
Re: SHA512 by default for GPG sigs
Posted by Martin Desruisseaux <ma...@geomatys.com>.
+0 on my side. Seems a good thing, but I may not master all the aspects.
Martin
Le 18/05/16 � 13:45, Christopher a �crit :
> Hi all,
>
> I'm not sure a better list to get feedback on, but I wanted to bring
> attention to the proposal here:
> https://issues.apache.org/jira/browse/MPOM-118
>
> Essentially this is a suggestion to configure the maven-gpg-plugin to sign
> using SHA512 as its digest algorithm in the ASF Parent POM, used by many
> Maven/Java-based projects within ASF. This configuration takes affect
> during software releases when this plugin is activated (typically prior to
> a release candidate vote, and staging a release in Nexus for distribution
> to Maven Central).
>
> This would only affect the hash algorithm used to generate GPG signatures
> for releases, and not any separate SHA/MD hashes published separately by
> any project, which can be weaker (SHA1, MD5) for convenience, and don't
> convey the strong authenticity statement that digital signatures provide.
>
> For background, gpg uses SHA1 by default, unless the signing key or gpg
> configuration has a preference to use another algorithm (as described on
> https://www.apache.org/dev/openpgp).
>
> This proposed configuration change wouldn't force the use of SHA512 (it
> could still be overridden by a project), but it would make it the default,
> which helps improve the security of releases in the case where release
> managers have failed to keep their configuration up-to-date with the best
> recommendations for using gpg.
>
> Thoughts? +1s? Discuss here or on the JIRA please.
>
> Thank you.