Re:Linus' reply on Git and SHA-1 collision
by raverbashing on Friday February 24, 2017 @04:50AM
(#13722340)
apt-get can (and do) check signatures of repos
But yeah, you could put an unverified repos to be used
Re:Linus' reply on Git and SHA-1 collision
by Perseids on Friday February 24, 2017 @05:47AM
(#13722565)
For the argument at hand (Can you deploy anything on a production server from a third party that is only verified cryptographically?) signatures and hashes fulfill the same function (and btw I also wrote "verifying it against a hash or signature" above). More to the point, under the hood GPG signatures only sign a hash of the file in question anyway. Verifying a file via a GPG signature is strictly less secure than verifying it by its hash (assuming you use the same hash function as the signature).
Git has tag signing, surely there's a way to clone a specific tag and check the signature against a specific GPG key fingerprint?
Re:Linus' reply on Git and SHA-1 collision
by nhaehnle on Friday February 24, 2017 @06:22AM
(#13722689)
Tag signatures only cover the mapping from tag name to commit hash. In other words, specifying a manually-verified commit hash is actually more secure.
Tag signatures are mostly worthless now from a crypto point of view -- with the caveat that you can still get some value from them if you still trust sha1 to be secure against second-preimage attacks.
Re:Linus' reply on Git and SHA-1 collision
by heartsucker on Friday February 24, 2017 @06:19AM
(#13722678)
git checkout 0.1.0
git tag -v 0.1.0
Fetching a file from the internet and verifying it against a hash or signature is the only way to securely deploy a package from the internet. This is exactly one of the use cases theses cryptographic primitives are built for. Don't blame the users when they utilize the tools the way they are supposed to be, blame the tools when they fail when doing so.
And by the way, if you ever need to run `apt-get upgrade` or `apt-get install` on your production server from a public mirror, then you are guilty of "deploying a package directly from the internet", too. (My apologies and congratulations if don't.)