Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5335

Re: Is packages build without verifying the source package signatures?

Show all headers | View raw

On Sat, 2017-12-02 at 12:15 +0100, Davide Prina wrote:
> If I don't mistake the automatic package build system don't require
> that the source signature is verified correctly.
[...]
> So it don't have the public key (?) and so it don't check the
> package  signature. But the package is build successfully... and
> signed.
> 
> If an attacker change the source and package it with a wrong private 
> key, it can have his "patch" applied to the signed binary packages?

The packages that the buildds are building come from the Debian
archives, where the software that accepts uploads verifies the
signatures on the uploads. The metadata for the upload queues is also
GPG-signed by the archive software.

So, no, in practice it's not feasible for the attacker to inject
packages outside of the trust structure without already having
compromised some other part of the infrastructure.

Regards,

Adam

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is packages build without verifying the source package signatures? Davide Prina <davide.prina@gmail.com> - 2017-12-02 12:20 +0100
  Re: Is packages build without verifying the source package  signatures? "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2017-12-02 13:50 +0100
  Re: Is packages build without verifying the source package signatures? Paul Wise <pabs@debian.org> - 2017-12-03 05:40 +0100
    Re: Is packages build without verifying the source package  signatures? Holger Levsen <holger@layer-acht.org> - 2017-12-03 11:50 +0100
      Re: Is packages build without verifying the source package  signatures? Bastian Blank <waldi@debian.org> - 2017-12-03 12:30 +0100
        Re: Is packages build without verifying the source package  signatures? Holger Levsen <holger@layer-acht.org> - 2017-12-03 12:50 +0100
          Re: Is packages build without verifying the source package  signatures? Bastian Blank <waldi@debian.org> - 2017-12-03 13:30 +0100
            Re: Is packages build without verifying the source package  signatures? Holger Levsen <holger@layer-acht.org> - 2017-12-03 14:00 +0100
          Re: Is packages build without verifying the source package  signatures? Clément Hermann <nodens@nodens.org> - 2017-12-04 01:20 +0100
    Re: Is packages build without verifying the source package  signatures? Kurt Roeckx <kurt@roeckx.be> - 2017-12-03 23:20 +0100

csiph-web