GNU bug report logs

#22883 Trustable "guix pull"

PackageSource(s)Maintainer(s)
guix PTS Buildd Popcon
Full log

Message #8 received at 22883@debbugs.gnu.org (full text, mbox, reply):

Received: (at 22883) by debbugs.gnu.org; 2 Mar 2016 19:26:44 +0000
From debbugs-submit-bounces@debbugs.gnu.org Wed Mar 02 14:26:44 2016
Received: from localhost ([127.0.0.1]:58119 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1abCQ0-00075T-A1
	for submit@debbugs.gnu.org; Wed, 02 Mar 2016 14:26:44 -0500
Received: from out3-smtp.messagingengine.com ([66.111.4.27]:37515)
 by debbugs.gnu.org with esmtp (Exim 4.84)
 (envelope-from <leo@famulari.name>) id 1abCPy-00075L-1E
 for 22883@debbugs.gnu.org; Wed, 02 Mar 2016 14:26:42 -0500
Received: from compute3.internal (compute3.nyi.internal [10.202.2.43])
 by mailout.nyi.internal (Postfix) with ESMTP id 67C1820A13;
 Wed,  2 Mar 2016 14:26:40 -0500 (EST)
Received: from frontend2 ([10.202.2.161])
 by compute3.internal (MEProxy); Wed, 02 Mar 2016 14:26:40 -0500
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=famulari.name; h=
 cc:content-type:date:from:in-reply-to:message-id:mime-version
 :references:subject:to:x-sasl-enc:x-sasl-enc; s=mesmtp; bh=jqkpY
 uXpM3Y8If5Dt1cvSDhSZB8=; b=x/wVsMrwQ3IHR2x0wMtrUd2dXKzIs26p6r4FZ
 iRb/FKuXEjYzBZG0lidMBVE9U5z8sXoNSzOl9+hiEycAlS1LD23t+czr3PjRcu0n
 qEXn9IgMa/N3Gf8AcEZESb40ismzSGNqwg2uUnDSB5vIZdGCwMCTdgwyGPBKwNqb
 abxBiA=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=
 messagingengine.com; h=cc:content-type:date:from:in-reply-to
 :message-id:mime-version:references:subject:to:x-sasl-enc
 :x-sasl-enc; s=smtpout; bh=jqkpYuXpM3Y8If5Dt1cvSDhSZB8=; b=h3fJK
 IzDwUKCUY6PT6lCiYjGo9/a7EWy7I8tlBQwBn+eymFOHvwxMIMYN7fien8WsdM06
 lwc3qKgYKHuLmZWnSCR5qzkRH+JKItHhbsqS5ryc095BNonIVlFBppAvNG22lpTn
 ekG0o914nfXHfs/86Q4Lq55ZraHXPnaadn4PF0=
X-Sasl-enc: /wlmlTbc3QjLa6843S0kEWbvLtASLJIeGH9VSboVzSE0 1456946800
Received: from localhost (c-69-249-5-231.hsd1.pa.comcast.net [69.249.5.231])
 by mail.messagingengine.com (Postfix) with ESMTPA id 1FC4A6801B9;
 Wed,  2 Mar 2016 14:26:40 -0500 (EST)
Date: Wed, 2 Mar 2016 14:26:42 -0500
From: Leo Famulari <leo@famulari.name>
To: Christopher Allan Webber <cwebber@dustycloud.org>
Subject: Re: bug#22883: Trustable "guix pull"
Message-ID: <20160302192642.GA16774@jasmine>
References: <87io14sqoa.fsf@dustycloud.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <87io14sqoa.fsf@dustycloud.org>
User-Agent: Mutt/1.5.24 (2015-08-30)
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 22883
Cc: 22883@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -0.7 (/)
On Wed, Mar 02, 2016 at 10:03:59AM -0800, Christopher Allan Webber wrote:
> Right now, when a user does a "guix pull", that pulls down the latest
> repository of code from git, which is kept in a tarball.  Once you
> receive the latest code, this has some checks: what's the hash of each
> package, etc.

A discussion worth having. But, let's merge this bug into
debbugs.gnu.org/22629. Also, we should read "The Update Framework" as
requested there.

> 
> Unfortunately, it's delivered over http:
> 
>   (define %snapshot-url
>     ;; "http://hydra.gnu.org/job/guix/master/tarball/latest/download"
>     "http://git.savannah.gnu.org/cgit/guix.git/snapshot/master.tar.gz"
>     )
> 
> At minimum we should deliver this over HTTPS, ideally with a single
> certificate that is trusted by the user, so the user can't be easily
> MITM'ed.
> 
> On top of that, even if you run from git proper what there isn't a test
> about is: can you trust those latest commits?  Git doesn't really check,
> at least by default.
> 
>   https://mikegerwitz.com/papers/git-horror-story
> 
> How about this: anyone with commit access should use "signed off by" and
> gpg signatures combined.  We should keep some list of guix committers'
> gpg keys.  No commit should be pushed to guix without a gpg signature.
> At this point, at least, there is some possibility of auditing things.
> 
> Perhaps before a master.tar.gz is made, there can be some integrity
> check of the commits matching the current set of "trusted" keys?
> 
> 
> 




Send a report that this bug log contains spam.


debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 01:05:13 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.