#22883 - Trustable "guix pull" - GNU bug report logs

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #189 received at 22883@debbugs.gnu.org (full text, mbox, reply):

Received: (at 22883) by debbugs.gnu.org; 1 May 2020 15:46:41 +0000
From debbugs-submit-bounces@debbugs.gnu.org Fri May 01 11:46:41 2020
Received: from localhost ([127.0.0.1]:50472 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1jUXs9-00036J-LJ
	for submit@debbugs.gnu.org; Fri, 01 May 2020 11:46:41 -0400
Received: from avior.uberspace.de ([185.26.156.32]:51754 ident=8SE6CMlvdKn)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <justus@sequoia-pgp.org>) id 1jUXs7-000368-Km
 for 22883@debbugs.gnu.org; Fri, 01 May 2020 11:46:40 -0400
Received: (qmail 31378 invoked from network); 1 May 2020 15:46:37 -0000
Received: from localhost (HELO europa) (127.0.0.1)
 by avior.uberspace.de with SMTP; 1 May 2020 15:46:37 -0000
Received: from localhost ([127.0.0.1]) by europa with esmtp (Exim 4.92)
 (envelope-from <justus@sequoia-pgp.org>)
 id 1jUXs2-0006dt-Gl; Fri, 01 May 2020 17:46:34 +0200
From: Justus Winter <justus@sequoia-pgp.org>
To: Ludovic Courtès <ludo@gnu.org>, Ricardo Wurmus
 <rekado@elephly.net>
Subject: Re: bug#22883: Authenticating a Git checkout
In-Reply-To: <87bln9oupo.fsf@gnu.org>
References: <87io14sqoa.fsf@dustycloud.org> <87h9ep8gxk.fsf@gnu.org>
 <20160426001359.GA23088@jasmine> <874majg0z8.fsf@gnu.org>
 <87bn3iz1xc.fsf_-_@gnu.org> <87wpket748.fsf@gnu.org> <87bmkwm8ed.fsf@gnu.org>
 <87png9o8i2.fsf@elephly.net> <87fth4bj6y.fsf@gnu.org>
 <87bln9oupo.fsf@gnu.org>
Date: Fri, 01 May 2020 17:46:34 +0200
Message-ID: <87sggjpsit.fsf@europa.jade-hamburg.de>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha256; protocol="application/pgp-signature"
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 22883
Cc: 22883@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

[Message part 1 (text/plain, inline)]

Ludovic Courtès <ludo@gnu.org> writes:

> At this stage, ‘make authenticate’ uses the pure-Scheme implementation
> (based on Göran Weinholt’s code, heavily modified).  It can authenticate
> 14K+ commits in ~20s instead of 4m20s on my laptop, which is really
> nice.

Neat :)

> Signature verification in (guix openpgp) does just that: signature
> verification.  It does not validate signature and key metadata, in
> particular expiration date.  I guess it should at least error out when a
> signature creation time is newer than its key expiration time.

Indeed.  I skimmed both the original and the adapted code, and it
notably does no attempt to canonicalize the certificates in the keyring
(i.e. checking binding signatures, lifetimes, revocations, (sub)key
flags...).  While that is a bit dangerous, it is okay for a point
solution for Guix, provided that this is properly documented and
communicated.

One can forgo canonicalization if one assumes that the keyring is
curated, and one has a good-list of (sub)keys fingerprints that are
allowed to create signatures.  Reading git-authentiate.scm that does
seem to be the case.

(I bet that certificate canonicalization is the major reason why calling
out to gpgv is so slow:  it does that every time, and it involves
signature verification, which is slow (yes, I'm looking at you, RSA).)

> It should also reject SHA1 signatures, at least optionally (I haven’t
> checked whether our Git history has any of these).

I believe it should.  For reference, we reject SHA1 signatures for
signatures created since 2013.

> Next steps:
>
>   • Clean up the (guix openpgp) API a bit, for instance by using proper
>     SRFI-35 error conditions.  Perhaps handle v5 packets too.

Don't bother with v5 packets for now.  The RFC is nowhere near
completion, and even if it is one day, it will be quite some time until
you see these packets in the wild.

All the best,
Justus

[signature.asc (application/pgp-signature, inline)]

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Tue Mar 11 07:01:53 2025; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#22883 Trustable "guix pull"