unsigned Gentoo latest files
Opened this issue · 3 comments
Gentoo latest files are apparently unsigned.
- file in question: http://distfiles.gentoo.org/releases/amd64/autobuilds/latest-stage3-amd64-hardened.txt (http://www.webcitation.org/6VY9gFGrq)
- folder: http://distfiles.gentoo.org/releases/amd64/autobuilds/ (http://www.webcitation.org/6VY9hYhkc)
This is problematic, because automated build scripts such as the @Securix-Linux can not verify this file. The adversary could use this to mount rollback 1 or indefinite freeze [2] attacks.
f_download "${SECURIX_STAGE3BASEURL}${STAGE3LATESTTXT}" "${GENTOO_STAGE3BASEURL}${STAGE3LATESTTXT}"
Related: #10
References:
[1] [2] Defined as per TUF (The Update Framework) - Attacks and
Weaknesses - Threat Model:
https://github.com/theupdateframework/tuf/blob/develop/SECURITY.md
http://www.webcitation.org/6F7Io2ncN
TODO:
- Check Gentoo tracker if they have any plans to sign them.
- Suggest this, if not yet.
bug report:
https://bugs.gentoo.org/show_bug.cgi?id=539954
Answer in short summary:
WONTFIX
That close the debate
On Feb 13, 2015 12:21 PM, "Patrick Schleizer" notifications@github.com
wrote:
Answer in short summary:
WONTFIX
—
Reply to this email directly or view it on GitHub
#19 (comment).