search

gazebosim / gazebo-classic

Gazebo classic. For the latest version, see https://github.com/gazebosim/gz-sim
http://classic.gazebosim.org/
Other
1.17k stars 477 forks source link

Securing Setup keys Step #1616

Open osrf-migration opened 9 years ago

osrf-migration commented 9 years ago

Original report (archived issue) by ruffsl (Bitbucket: Ruffin White).

As I was reading through some new proposed security guidelines for official docker hub images, I realized our Step-by-step Install is still instructing people to use http for retrieving the singed keys for the Gazebo repository.

This is of course quite insecure and I would suggest we migrate to a better method. ROS has adjusted it wiki install instructions to use https by hosting the keys on in rosdistro and piggybacking off GitHub's https certification. I would guess something quite similar ineffective could be done here with Bitbucket.

This would also aid in my effort in getting Gazebo an official DockerHub image.
Thanks!

osrf-migration commented 9 years ago

Original comment by Steve Peters (Bitbucket: Steven Peters, GitHub: scpeters).

@_jrivero_ should we commit our packages.osrfoundation.org key to the release-tools repository?

osrf-migration commented 9 years ago

Original comment by ruffsl (Bitbucket: Ruffin White).

Looks like the best method is to use a keyserver, as I was informed here in another PR. So maybe hosting the key on the repo is moot unless we expect to change it frequently?

osrf-migration commented 9 years ago

Original comment by Jose Luis Rivero (Bitbucket: Jose Luis Rivero, GitHub: j-rivero).

Hosting the key in the repo is not difficult.

Modifying the instructions to use fingerprints is ready. With this change we save the installation of wget and trust on the apt-key tool to handle the whole process for us, which I think is a good thing. However, as you said, we will lost the abstraction over the key fingerprint and need to change documentation when the key changes (hopefully not very often).

osrf-migration commented 8 years ago

Original comment by ruffsl (Bitbucket: Ruffin White).

Well, my docker hub issue is currently resolved via this implementation here.
apt-key adv --keyserver ha.pool.sks-keyservers.net --recv-keys D2486D2DD83DB69272AFE98867170598AF249743
But perhaps it might be worth while suggesting this securer approach in the wiki install above?

osrf-migration commented 8 years ago

Original comment by Nate Koenig (Bitbucket: Nathan Koenig).