[arch-general] Severity of Failed checksum for PKGBUILD

[Florian Pelz]

On 02/20/2015 03:59 PM, Daniel Micay wrote:
> The vast majority of users make use of the binary packages and the 
> checksums do absolutely nothing to secure the main attack vector
> which is a compromise of the sources downloaded by the packager. It
> is only relevant to the tiny minority of people building a package
> with ABS.
> 
> The more meaningful compromise needs to happen to the actual
> package in the repositories. A compromise of the server hosting the
> sources is the most likely way for this to happen. HTTPS can't do
> anything to defend against it. HTTPS can only defend against a MITM
> attack on a specific downstream packager.
> 

The difference is that if certain government organizations infiltrate
the Arch servers or upstream, they break everyone's security. They may
be less likely to do that compared to breaking just yours.

> There is support for validating sources with GPG signatures, which
> is a complete solution to this issue. If you care, then file issues
> for any packages that aren't using the upstream signatures yet, and
> complain to upstream if they aren't signing the releases.
> 

This certainly is the right way to go, but I don't think enough
upstream projects care to make it a viable option for personal
computers today. PKGBUILD checksums provide less security, but they do
provide some.

> On 20/02/15 09:41 AM, Florian Pelz wrote:
>> I'm not sure if downloads over the git:// protocol are actually 
>> verified, because the transfer is definitely not secure. I do
>> hope so.
> 
> Git's read-only protocol is not authenticated. It supports SSH and
> HTTPS which do have two different forms of authentication, both of
> which are very flawed. Signed tags make a lot more sense, and you
> shouldn't be using code from development branches if you care a lot
> about robustness and security, since
> 

It is not authenticated, but I care about checksums. (Authentication
would be even better because it ensures others don't know what
software I am running -- but that is too much to ask.) I don't see why
SSH and HTTPS are flawed, other than a distrust in certificate
authorities.

I still hope that git:// downloads use checksums. I'm not sure.

Greetings,
Florian