[Bug 868440] New: rpm verifies but still continues if the signature's key is missing
https://bugzilla.novell.com/show_bug.cgi?id=868440 https://bugzilla.novell.com/show_bug.cgi?id=868440#c0 Summary: rpm verifies but still continues if the signature's key is missing Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: jnelson-suse@jamponi.net QAContact: qa-bugs@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:27.0) Gecko/20100101 Firefox/27.0 See here: http://forums.opensuse.org/showthread.php/496213-zypper-up-found-no-key-but-... I'm not a participant in that thread, but I feel very very strongly about this. IMO, it's unacceptable that zypper would install an rpm without a known valid signature. At the very least, this should be a configurable setting or a yes/no question from zypper. Reproducible: Always Steps to Reproduce: 1. 2. 3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=868440 https://bugzilla.novell.com/show_bug.cgi?id=868440#c1 Marcus Meissner <meissner@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner@suse.com --- Comment #1 from Marcus Meissner <meissner@suse.com> 2014-03-14 19:36:02 UTC --- we verify the YUM repository consistency. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=868440 https://bugzilla.novell.com/show_bug.cgi?id=868440#c2 --- Comment #2 from Jon Nelson <jnelson-suse@jamponi.net> 2014-03-15 16:06:04 UTC --- Yes, but that's not the same thing. rpm signature verification has been around a long time. Allowing the installation of unsigned or signed-but-non-verifiable (or even signed-but-wrong!) rpms *even if* the repo data is signed (and matches) is still a security risk. A small bug in properly verifying the repo signature opens an enormous security hole. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=868440 https://bugzilla.novell.com/show_bug.cgi?id=868440#c Xiyuan Liu <xyliu@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |xyliu@suse.com AssignedTo|bnc-team-screening@forge.pr |zypp-maintainers@forge.prov |ovo.novell.com |o.novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=868440 https://bugzilla.novell.com/show_bug.cgi?id=868440#c3 --- Comment #3 from Michael Schröder <mls@suse.com> 2014-03-17 10:23:19 UTC --- I don't see how this can be a "enormous security hole" for you. Trusting the repo but not trusting the rpms in the repo does not make any sense to me. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=868440 https://bugzilla.novell.com/show_bug.cgi?id=868440#c4 --- Comment #4 from Jon Nelson <jnelson-suse@jamponi.net> 2014-03-17 15:21:59 UTC --- Trusting the repo alone is not sufficient. A compromise of the repo signature mechanism, due to bug or design, allows the installation of any number of unsigned or wrongly-signed rpms. Think of the repo as an envelope and the rpms as a (signed!) document. Inspecting the integrity of the envelope is not a sufficient guarantee that the document has not also been altered. Security is about layers, and relying on only one layer here is a problem. I would like to include the security team in this discussion. How is that done? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com