From: Jonathon Fernyhough Sent: Wed Aug 08 18:09:30 CEST 2018 To: Subject: Re: [arch-general] Kernel source URL change

On 08/08/18 12:43, Geo Kozey via arch-general wrote:

...

This can impose security risks on Arch as we now have to trust their github infra rather than kernel.org (we all know what happened to gentoo recently)

Just to provide some perspective, kernel.org itself had a major issue a few years back [1][2][3]. kernel.org was down for several weeks after that incident, and IIRC this prompted them to start using GitHub (at least as a mirror; my memory is fuzzy as I wasn't paying all that much attention to that sort of thing seven years ago).

IIRC in 2011 Arch didn't even used gpg for signing packages so it's quite ancient time.

If you don't trust the Arch-run/administered infrastructure you can't really trust any of the packages in the repos either.

The point was that before changes no user had to care about https://github.com/Archlinux and now it's critical infrastructure for self-hosting package sources.

[1] https://www.theregister.co.uk/2011/08/31/linux_kernel_security_breach/ [2] https://en.wikipedia.org/wiki/Kernel.org [3] https://www.linuxfoundation.org/blog/2011/08/the-cracking-of-kernel-org/

Yours sincerely G. K.

On 8/8/18 4:11 PM, Tharre via arch-general wrote:

On 08/08, Geo Kozey via arch-general wrote:

...

There is no tradition in Arch to self-host package sources as Debian does unless upstream has completely broken release process. This can impose security risks on Arch as we now have to trust their github infra rather than kernel.org (we all know what happened to gentoo recently). I'm aware that Barthalion made an effort to hardenize Arch github infra but still this is a new risk which didn't exist before. [...] The point was that before changes no user had to care about https://github.com/Archlinux and now it's critical infrastructure for self-hosting package sources.

No, nobody has to trust github or for that fact kernel.org. The commits/tags are *signed* and thus makepkg will check if that signature matches one of those specified in the validpgpkeys array.

From a security standpoint, it's irrelevant if the sources come from arch hosted infra, from github, or from kernel.org.

I'm all for hosting it through bittorrent TBH. -- Eli Schwartz Bug Wrangler and Trusted User