Re: Reflections on Trusting Trust

From: Kris Kennaway (kris_at_obsecurity.org)
Date: 11/30/05

  • Next message: Colin Percival: "Re: Reflections on Trusting Trust" 
    Date: Tue, 29 Nov 2005 19:05:52 -0500
To: Colin Percival <cperciva@freebsd.org>

    On Tue, Nov 29, 2005 at 03:43:11PM -0800, Colin Percival wrote:
    > Kris Kennaway wrote:
    > > I'd be happy to work with someone who can implement a solution for the
    > > package side. The important thing to keep in mind is that packages
    > > are built automatically on many distributed machines. Any solution
    > > for signing packages would therefore need to also be automated,
    > > e.g. signing them automatically when the packages are pulled back from
    > > the build client to server.
    >
    > Even before you get to that point, you have to worry about making sure
    > that the build clients are secure. One possibility which worries me a
    > great deal is that a trojan in the build code for a low-profile port
    > (e.g., misc/my-port-which-nobody-else-uses) could allow an attacker to
    > gain control of a build client (and then insert trojans into packages
    > which are built there).

    They're closed systems that I keep up-to-date with security fixes, but
    yes, this is something that we do not defend against. As you note,
    it's not really practical to at the moment, so the best we can do is
    just keep it in mind and look for other things to fix.

    Kris

  • Next message: Colin Percival: "Re: Reflections on Trusting Trust"

    Relevant Pages

    • Re: 4 CD set
      ... Kris Kennaway wrote: ... >>Yea I did download same via 56k and a few extras like Abiword via ADSL ... I guess it's the two official plus some extra packages ...
      (comp.unix.bsd.freebsd.misc)
    • Re: FreeBSD 5.2.1
      ... > Kris Kennaway wrote: ... > broadband who will burn stuff to CDs for me. ... Some of the OpenOffice packages are now buildable (there ... main package and not the localized packages, ...
      (comp.unix.bsd.freebsd.misc)
    • Re: cleaning FreeBSD
      ... Kris Kennaway wrote: ... >>way to clean out old unused programming sections like this in FreeBSD 5.4? ... Okay so it won't tell me what packages they tied to. ... There should be a way to found out what pkg a file belongs to, ...
      (comp.unix.bsd.freebsd.misc)
    • Re: pkg_create broken by design?
      ... On Tue, 24 Jun 2003, Kris Kennaway wrote: ... > Look into the ports collections for thousands of examples of how to ... > create packages. ... what I don't understand is why 'tar' wants to chdir to the unpack ...
      (freebsd-hackers)
    • Re: 4 CD ISOs for 5.2 ?
      ... On Tuesday, February 03, 2004 6:11 PM, Kris Kennaway wrote: ... > two contain a subset of packages; the full set of packages is ... I generally download the ISOs from my office, where I have Windows. ...
      (freebsd-questions)