search

multipath-tcp / mptcpd

mptcpd is a daemon for Linux that performs Multipath TCP path management related operations in the user space 😈
https://mptcpd.mptcp.dev/
BSD 3-Clause "New" or "Revised" License
184 stars 38 forks source link

Sign new releases #217

Closed matttbe closed 1 year ago

matttbe commented 2 years ago

Is your feature request related to a problem? Please describe.

According to the Debian guidelines, it is a good practice to sign all releases made by a project: git tags and tarballs.

Of course, not all upstreams provide such signatures but you could request them as a way of verifying that no third party has modified the code after its release (projects such as phpmyadmin, unrealircd, and proftpd have suffered from this kind of attack).

Source: https://lintian.debian.org/tags/debian-watch-does-not-check-gpg-signature

Describe the solution you'd like

Sign git tags and tarballs. For the tarballs, please ideally use the same name + .sig or .sign (or similar).

Describe alternatives you've considered

It is a recommendation that seems to make sense, up to you ;-)

Additional context

It is common to see .sig or .sign files for projects strongly linked to the Linux kernel, e.g. iproute2, iwd, libnl, etc.

ossama-othman commented 2 years ago

Additional Notes

GitHub Documentation: Signing tags Debian Wiki: Creating signed GitHub releases

matttbe commented 2 years ago

@ossama-othman : I see that the v0.10 release has been signed (there is a .sig file), thank you for that!

I'm just confused now because this task is planned for v0.11. Do you still need to do more? What is probably missing is to publish the public key somewhere, e.g. wiki, doc, keyserver.ubuntu.com :-) (and maybe have this key signed by others :) )

$ gpg --verify mptcpd-0.10.tar.gz.sig
gpg: assuming signed data in 'mptcpd-0.10.tar.gz'
gpg: Signature made Fri 24 Jun 2022 22:43:05 CEST
gpg:                using RSA key CFD26ABD50BEDF3FC7E018403EF2B8C1B2BD215A
gpg: Can't check signature: No public key
ossama-othman commented 2 years ago

I'm just confused now because this task is planned for v0.11. Do you still need to do more? What is probably missing is to publish the public key somewhere, e.g. wiki, doc, keyserver.ubuntu.com :-) (and maybe have this key signed by others :) )

@matttbe I was planning on adding a Makefile target to generate the .sig file, but I didn't get around to doing that for the v0.11 release. I also uploaded my public key to keyserver.ubuntu.com, but it hasn't been signed by anyone else yet.