search

radvd-project / radvd

radvd | Official repository: https://github.com/radvd-project/radvd
https://radvd.litech.org/
Other
203 stars 106 forks source link

Archive detached signature #129

Closed vp1981 closed 3 years ago

vp1981 commented 4 years ago

Hello, versions prior to 2.19 have detached signatures (.asc) but 2.19 doesn't have one. Is it on purpose? Should I use github git repo as verified source of radvd?

reubenhwk commented 4 years ago

I'd suggest using Github. I'm not keen on continuing to maintain the RADVD website and I'd like to replace it with a message to get all future updates from Github.

On Wed, Nov 4, 2020 at 12:21 AM Vladimir Lomov notifications@github.com wrote:

Hello, versions prior to 2.19 have detached signatures (.asc) but 2.19 doesn't have one. Is it on purpose? Should I use github git repo as verified source of radvd?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/reubenhwk/radvd/issues/129, or unsubscribe https://github.com/notifications/unsubscribe-auth/AABRG6YJSBEOGYYPMMOQC4LSOEFHRANCNFSM4TJXUVHA .

vp1981 commented 4 years ago

Hello. Yes, I already use source from github (I'm using Archlinux and has updated PKGBUILD to build new radvd fetching source from github). May be it is worth to sign tags then? Right now I don't use such feature but think it would valuable thing to have. And small nitpick: the "Release" part of "main" page on github leads to "Release" page that doesn't list latest release, I see it only on "Tag" page.

anthraxx commented 4 years ago

@reubenhwk I understand that you do not want to maintain the website, however would it be possible to gpg sign your git tags or upload detatched signatures to the git releases?

git archive -o radvd-2.19.tar.gz --format tar.gz --prefix=radvd-2.19/ 2.19
gpg --detach-sign radvd-2.19.tar.gz

you can put that in a Makefile/script and use some variables. It would be super awesome if you can keep signing releases, this is a important part of supply chain security authenticating the legitimacy of a release from you, the author.

Neustradamus commented 3 years ago

I think it is needed to have a perfect 2.20 soon.

With a perfect announcement at the same time:

Neustradamus commented 3 years ago

@reubenhwk: There is a big problem for Debian 11, the freeze is soon (2021-01-12). The next will be in 2023.

Can you solve it with a 2.20 now? Please read all steps to do at the same time?

The 2.19 is not here: https://tracker.debian.org/pkg/radvd cc @stappersg

It is linked to:

Thanks in advance.

Neustradamus commented 3 years ago

@vp1981 @anthraxx @stappersg: @reubenhwk has generated signatures:

foxxx0 commented 3 years ago

Unfortunately these signatures have been made with a RSA key 0xBE8BA2B61F1B1E57 that I can't seem to find anywhere.

 $ gpg --list-packets < radvd-2.19.tar.gz.asc 
# off=0 ctb=89 tag=2 hlen=3 plen=435
:signature packet: algo 1, keyid BE8BA2B61F1B1E57
    version 4, created 1610178092, md5len 0, sigclass 0x00
    digest algo 10, begin of digest 11 55
    hashed subpkt 33 len 21 (issuer fpr v4 BABABE4BCC326327BFB6C133BE8BA2B61F1B1E57)
    hashed subpkt 2 len 4 (sig created 2021-01-09)
    subpkt 16 len 8 (issuer key ID BE8BA2B61F1B1E57)
    data: [3072 bits]

The previous released have been signed with RSA key 0x6FE19F21451C9A2B / fingerprint 10E2 5110 3817 2B51 6DCA 5BD3 6FE1 9F21 451C 9A2B and uid Reuben Hawkins <reubenhwk@gmail.com>.

So as of right now, these signatures aren't helping at all.

stappersg commented 3 years ago

So as of right now, these signatures aren't helping at all.

@anthraxx expressed it already very well earlier:

It would be super awesome if you can keep signing releases, this is a important part of supply chain security authenticating the legitimacy of a release from you, the author.

I think #135 is both problem and solution.

Neustradamus commented 3 years ago

@reubenhwk has generated signatures and it is the last 2.19 from him.

@reubenhwk, can you look the problem of signatures before?

The radvd repositories have been moved from:

Thanks in advance.

Neustradamus commented 3 years ago

Currently, there is always the original website, files and signatures are on it too:

Neustradamus commented 3 years ago

@vp1981 @anthraxx @foxxx0, @stappersg: @robbat2 has done new signatures:

foxxx0 commented 3 years ago

Thanks, but in order to keep the trust chain intact, we still need a gpg-signed statement from @reubenhwk (with 0x6FE19F21451C9A2B / fp 10E2 5110 3817 2B51 6DCA 5BD3 6FE1 9F21 451C 9A2B) that @robbat2 is now in charge of this project and explicitly stating that their key 0xEE05E6F6A48F6136 with fingerprint 7D0B 3CEB E9B8 5B1F 825B CECF EE05 E6F6 A48F 6136 is now the official and approved new release signing key.

Otherwise having the releases signed with a different "untrusted" (no offense) gpg key doesn't really mean anything.

Neustradamus commented 3 years ago

@foxxx0: @robbat2 has already worked previously:

robbat2 commented 3 years ago

@foxxx0 Reuben's old key is no longer available. Reuben does have a new key, but there's no meaningful handover message possible since Reuben lost their old key.

From my newer key 0xEE05E6F6A48F6136, you can see transitive signatures to my older key 0xEE05E6F6A48F6136, and then onto the main kernel WoT.

I'll also point out that there was also no chain of trust between Reuben's older key 0x411FA8C112D91A31:

radvd-2.16.tar.gz.asc 2017-02-01 411FA8C112D91A31
radvd-2.17-rc1.tar.gz.asc 2017-07-02 411FA8C112D91A31
radvd-2.17.tar.gz.asc 2017-07-04 411FA8C112D91A31
radvd-2.18-rc1.tar.gz.asc 2019-02-17 6FE19F21451C9A2B
radvd-2.19.tar.gz.asc 2021-01-21 19395F23C58826C4
stappersg commented 3 years ago

On Fri, Jan 22, 2021 at 10:49:40AM -0800, Robin H. Johnson wrote:

... chain of trust ...

Each chain has to start with a first link

robbat2 commented 3 years ago

A question for both @foxxx0 @stappersg: As @reubenhwk has lost their prior keys, what further assurances do you believe are possible and meaningful to show that @reubenhwk has handed control of the project to myself and @Neustradamus?

Once we've got most of this sorted out, including getting more willing developers into the GitHub organization, so they can provide meaningful reviews of code, I would like to move the radvd project to having dedicated formal release keys, so that we can avoid future problems in handover (having enough open source experience to know that nobody will be around forever, regardless of their best intentions).

Neustradamus commented 3 years ago

Solved by @robbat2.

Neustradamus commented 3 years ago

One hour ago, @reubenhwk has done a comment here: https://github.com/radvd-project/radvd/issues/135#issuecomment-773455436.

@stappersg: Can you now update radvd in Debian?

@foxxx0: Can you now update radvd in Arch Linux?

Thanks in advance.

stappersg commented 3 years ago

https://github.com/radvd-project/radvd-project.github.io/commit/6e3e5f7e20076052139734b63635810eafa04553 where to get the pubkey of which it was done with?

Neustradamus commented 3 years ago

@stappersg: It is here:

I have added links in index.html: