News for hackers. Stuff that matters.

A comment on Sigstore protects Apt archives: apt-verify and apt-sigstore. Parent comment

Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by a_vanderbilt on Sunday April 16, 2023 @01:23PM (#35592118)
It's an unpopular take, but I think Debian is less than ideal with how they secure packages. Per-package signing is not the expectation in Debian-land, and the two main ways of signing packages aren't supported by the main repos. They strip the code-signatures even if you submit a package with them. The usual response I receive is "the package hashes list is signed so it gets security by proxy". What about software obtained off-repo? How do I know that the code the developer wrote is what I am running? Package signatures give us that ability. RPM has adopted per-package signing as the default years ago, why doesn't Debian?
[ Parent | on HN ]
Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by sillystuff on Sunday April 16, 2023 @02:51PM (#35593106)
Individual package signing does seem more straightforward. But, signing a file containing a list of hashes of the individual package files, as Debian does, accomplishes the same verification of package integrity when installing from a repo.

I'm guessing the genesis was since Debian already checked package hashes to ensure no download issues, adding a cryptographic signature to the file containing those hashes was an easy, minimal change that would not break existing clients that didn't know to check it.

Off repo is a use case that IMO should be strongly discouraged (as should adding random repos), but to your point, if you have no choice, a per-package sig would be useful.

[ Parent | on HN ]
Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by bombolo on Sunday April 16, 2023 @06:06PM (#35594704)
> How do I know that the code the developer wrote is what I am running?

Because of reproducible builds?

[ Parent | on HN ]
Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by a_vanderbilt on Sunday April 16, 2023 @07:28PM (#35595133)
How would you reproduce the build on systems that are not capable of performing the build due to hardware or practical constraints? If I am obtaining closed-source packages, how do I reproduce those builds? The benefit of signing is adjacent, but not the same as the need to confirm the output of the build process.
[ Parent | on HN ]
Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by bombolo on Monday April 17, 2023 @01:52AM (#35597242)
If you're getting closed source, certainly debian has nothing to do with it and you have to take issue with your distributor?
[ Parent | on HN ]
Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by a_vanderbilt on Monday April 17, 2023 @01:46PM (#35604055)
Debian defines the package format and fosters the culture around that format. Third-parties who wish to distribute software via Debian packages have to use the standard that Debian has decided upon. I am taking up the issue with Debian, as the distributor of the Debian package format.
[ Parent | on HN ]
Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by bombolo on Monday April 17, 2023 @05:38PM (#35606968)
Ok.

But what kind of magic signature do you want to know that the code you're running matches the source, if the software is closed source and you have no access to the source?

Your requirement makes no sense. Are you a product manager? :D

[ Parent | on HN ]
Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by a_vanderbilt on Monday April 17, 2023 @11:22PM (#35609598)
Re-read my initial reply to the thread. It is stated.
[ Parent | on HN ]
Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by bombolo on Tuesday April 18, 2023 @01:42AM (#35610364)
gpg can be used to sign a single file, if for any reason you download a single .deb instead of using a repository.

If your supplier doesn't sign them… take it with them?

[ Parent | on HN ]