[Catalog-sig] [Draft] Package signing and verification process

[Giovanni Bajo]

Il giorno 06/feb/2013, alle ore 22:17, martin at v.loewis.de ha scritto:

>> Right, but then we are again back to trusting a central authority, in
>> this case plone.org. If we can trust plone.org, why can't we trust
>> Python.org?
> 
> Some people might be concerned that PyPI could have been hacked, spreading
> viruses. Only signing by the original author can detect this attack.
> 
>> My suggestion earlier was that whatever system we have will by default
>> trust python.org. Or heck, we can even let the tools ask if it should
>> trust python.org. And then things are good.
> 
> That's pretty much the status quo, except that you need to verify that
> you really "got" the package from python.org. For that, either a validation
> of the (existing) SSL server certificate, or the validation of the
> (existing) master mirror signatures would be sufficient.


The point that we're making is that adding a layer of GPG signature checking to package managers would allow to detect attacks that corrupt the packages themselves on PyPI, and to use third-party CDNs for file distributions without having to trust them.

"Trusting PyPI" doesn't mean that we shouldn't try to defend from possible vulnerabilities in PyPI itself. GPG signatures allow us to defend from attacks that can modify the file storage and/or upload packages from unauthorized sources. Obviously, it doesn't solve attacks that manage to get write access to the user DB where the GPG fingerprint for each package is registered.

-- 
Giovanni Bajo   ::  rasky at develer.com
Develer S.r.l.  ::  http://www.develer.com

My Blog: http://giovanni.bajo.it





-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4346 bytes
Desc: not available
URL: <http://mail.python.org/pipermail/catalog-sig/attachments/20130207/dd36a5e7/attachment-0001.bin>