Is packages build without verifying the source package signatures?

From	Davide Prina <davide.prina@gmail.com>
Newsgroups	linux.debian.security
Subject	Is packages build without verifying the source package signatures?
Date	2017-12-02 12:20 +0100
Message-ID	<uSdZT-P9-15@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

If I don't mistake the automatic package build system don't require that 
the source signature is verified correctly.

In here:
https://buildd.debian.org/status/fetch.php?pkg=gnome-shell&arch=amd64&ver=3.26.2-1&stamp=1509919343&raw=0

I have found this:

Unpack source
-------------

gpgv: unknown type of key resource 'trustedkeys.kbx'
gpgv: keyblock resource '/sbuild-nonexistent/.gnupg/trustedkeys.kbx': 
General error
gpgv: Signature made Sun Nov  5 19:11:53 2017 UTC
gpgv:                using RSA key 09B3AC2ECB169C904345CC546AE1DF0D608F22DC
gpgv:                issuer "biebl@debian.org"
gpgv: Can't check signature: No public key
dpkg-source: warning: failed to verify signature on 
./gnome-shell_3.26.2-1.dsc
dpkg-source: info: extracting gnome-shell in /<<PKGBUILDDIR>>
dpkg-source: info: unpacking gnome-shell_3.26.2.orig.tar.xz
dpkg-source: info: unpacking gnome-shell_3.26.2-1.debian.tar.xz
dpkg-source: info: applying 27-nm-libexec-path.patch
dpkg-source: info: applying workaround_crasher_fractional_scaling.patch

So it don't have the public key (?) and so it don't check the package 
signature. But the package is build successfully... and signed.

If an attacker change the source and package it with a wrong private 
key, it can have his "patch" applied to the signed binary packages?

Ciao
Davide

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Is packages build without verifying the source package signatures? Davide Prina <davide.prina@gmail.com> - 2017-12-02 12:20 +0100
  Re: Is packages build without verifying the source package  signatures? "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2017-12-02 13:50 +0100
  Re: Is packages build without verifying the source package signatures? Paul Wise <pabs@debian.org> - 2017-12-03 05:40 +0100
    Re: Is packages build without verifying the source package  signatures? Holger Levsen <holger@layer-acht.org> - 2017-12-03 11:50 +0100
      Re: Is packages build without verifying the source package  signatures? Bastian Blank <waldi@debian.org> - 2017-12-03 12:30 +0100
        Re: Is packages build without verifying the source package  signatures? Holger Levsen <holger@layer-acht.org> - 2017-12-03 12:50 +0100
          Re: Is packages build without verifying the source package  signatures? Bastian Blank <waldi@debian.org> - 2017-12-03 13:30 +0100
            Re: Is packages build without verifying the source package  signatures? Holger Levsen <holger@layer-acht.org> - 2017-12-03 14:00 +0100
          Re: Is packages build without verifying the source package  signatures? Clément Hermann <nodens@nodens.org> - 2017-12-04 01:20 +0100
    Re: Is packages build without verifying the source package  signatures? Kurt Roeckx <kurt@roeckx.be> - 2017-12-03 23:20 +0100

csiph-web