Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5336

Re: Is packages build without verifying the source package signatures?

Show all headers | View raw

On Sat, Dec 2, 2017 at 7:15 PM, Davide Prina wrote:

> If I don't mistake the automatic package build system don't require that the
> source signature is verified correctly.

To clarify what Adam said; there are two times where source package
verification can happen during builds. The first is during "Download
source files with APT", which verifies hashes of the source files
against the hashes known for those files by apt, the keys for this
stage are the archive keys. The second is during "Unpack source",
which runs dpkg-source to extract the source package and (if all
Debian package uploader keys are installed) verifies the signature of
the source package matches a known developer key.

The Debian buildds only do the first verification (due to all Debian
package uploader keys not being installed) but the Debian archive
verifies that all uploads match a known developer key before passing
packages to the buildds. So in practice, both verifications are
happening, but not in the same place.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is packages build without verifying the source package signatures? Davide Prina <davide.prina@gmail.com> - 2017-12-02 12:20 +0100
  Re: Is packages build without verifying the source package  signatures? "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2017-12-02 13:50 +0100
  Re: Is packages build without verifying the source package signatures? Paul Wise <pabs@debian.org> - 2017-12-03 05:40 +0100
    Re: Is packages build without verifying the source package  signatures? Holger Levsen <holger@layer-acht.org> - 2017-12-03 11:50 +0100
      Re: Is packages build without verifying the source package  signatures? Bastian Blank <waldi@debian.org> - 2017-12-03 12:30 +0100
        Re: Is packages build without verifying the source package  signatures? Holger Levsen <holger@layer-acht.org> - 2017-12-03 12:50 +0100
          Re: Is packages build without verifying the source package  signatures? Bastian Blank <waldi@debian.org> - 2017-12-03 13:30 +0100
            Re: Is packages build without verifying the source package  signatures? Holger Levsen <holger@layer-acht.org> - 2017-12-03 14:00 +0100
          Re: Is packages build without verifying the source package  signatures? Clément Hermann <nodens@nodens.org> - 2017-12-04 01:20 +0100
    Re: Is packages build without verifying the source package  signatures? Kurt Roeckx <kurt@roeckx.be> - 2017-12-03 23:20 +0100

csiph-web