Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5338

Re: Is packages build without verifying the source package signatures?

Show all headers | View raw

On Sun, Dec 03, 2017 at 10:41:17AM +0000, Holger Levsen wrote:
> On Sun, Dec 03, 2017 at 12:38:24PM +0800, Paul Wise wrote:
> > The Debian buildds only do the first verification (due to all Debian
> > package uploader keys not being installed) but the Debian archive
> > verifies that all uploads match a known developer key before passing
> > packages to the buildds. So in practice, both verifications are
> > happening, but not in the same place.
> in practice, this also has obvious flaws.

Please elaborate.

>                                           what's the technical reason
> the buildds are not checking the signatures?

Unavailability of the keys.  Key may have been expired between upload
and build attempt.

Bastian

-- 
Leave bigotry in your quarters; there's no room for it on the bridge.
		-- Kirk, "Balance of Terror", stardate 1709.2

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is packages build without verifying the source package signatures? Davide Prina <davide.prina@gmail.com> - 2017-12-02 12:20 +0100
  Re: Is packages build without verifying the source package  signatures? "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2017-12-02 13:50 +0100
  Re: Is packages build without verifying the source package signatures? Paul Wise <pabs@debian.org> - 2017-12-03 05:40 +0100
    Re: Is packages build without verifying the source package  signatures? Holger Levsen <holger@layer-acht.org> - 2017-12-03 11:50 +0100
      Re: Is packages build without verifying the source package  signatures? Bastian Blank <waldi@debian.org> - 2017-12-03 12:30 +0100
        Re: Is packages build without verifying the source package  signatures? Holger Levsen <holger@layer-acht.org> - 2017-12-03 12:50 +0100
          Re: Is packages build without verifying the source package  signatures? Bastian Blank <waldi@debian.org> - 2017-12-03 13:30 +0100
            Re: Is packages build without verifying the source package  signatures? Holger Levsen <holger@layer-acht.org> - 2017-12-03 14:00 +0100
          Re: Is packages build without verifying the source package  signatures? Clément Hermann <nodens@nodens.org> - 2017-12-04 01:20 +0100
    Re: Is packages build without verifying the source package  signatures? Kurt Roeckx <kurt@roeckx.be> - 2017-12-03 23:20 +0100

csiph-web