https://bugzilla.novell.com/show_bug.cgi?id=367666 Cyril Hrubis changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.provo.novell.com |poeml@novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=367666 User adrian@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=367666#c2 Adrian Schröter changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|adrian@novell.com | --- Comment #2 from Adrian Schröter 2008-03-07 00:18:24 MST --- osc can get the keys either via the repos (located in repodata/repomd.xml.key) or via api calls. One aspect is that installing packages also to a build root hosted within chroot (not XEN) is almost as insecure as installing it into the system (regarding attacks by intention, not bugs happen by accident). So in any case, osc should point the user to this and ask if he anyway want to start the build by trusting these further repos, which are obviously not yet accepted in his system rpm database. Afterwards, osc could either import the keys into the system wide rpm database or finding some way to tell rpm running in the build script to use an additional key (or keyring). A complete different (alternative) option would be to support XEN, qemu or any other virtualisation builds better on packager workstations. qemu should be easily doable in the build script (maybe I do this these days), it would slow down the build, but makes it hopefully secure in a way that the trust aspect becomes less important. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=367666 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=367666#c4 --- Comment #4 from Ludwig Nussel 2008-03-07 02:14:18 MST --- The build script itself doesn't care about signatures, It just assumes that everything it gets is already verified. So all the magic is done by osc. It should just behave like e.g. zypper. Ie download the key, show the fingerprint and ask the user whether to trust it. qemu does not protect against intentionally malicious code either. I already have qemu (and uml) support in lbuild nevertheless though. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=367666 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=367666#c6 --- Comment #6 from Ludwig Nussel 2008-03-07 02:42:41 MST --- You can even get around the need for root at all by using a temporary rpm database (rpm --dbpath /tmp/something) for all keys. Has the additional advantage the the local installation still wouldn't trust those keys. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=367666 User poeml@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=367666#c8 Peter Poeml changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO Info Provider| |gerberb@zenez.com --- Comment #8 from Peter Poeml 2008-03-31 04:17:39 MST --- Please provide documentation about downloading of keys on https://api.opensuse.org/apidocs/. Thanks! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=367666 User gerberb@zenez.com added comment https://bugzilla.novell.com/show_bug.cgi?id=367666#c10 --- Comment #10 from Boyd Gerber 2008-05-20 08:25:07 MST --- I do not know what other information I need to give. The GPG/PGP signatures are not available. We really need them. What information can I provide? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=367666 User abauer@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=367666#c12 Andreas Bauer changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |abauer@novell.com AssignedTo|abauer@novell.com |poeml@novell.com --- Comment #12 from Andreas Bauer 2008-05-20 09:12:29 MST --- docs are updated, https://api.opensuse.org/apidocs#13 reassigning to peter -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=367666 User poeml@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=367666#c14 Peter Poeml changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW Info Provider|abauer@novell.com | --- Comment #14 from Peter Poeml 2008-05-20 11:23:32 MST --- Oh. I had not read all mails yet. It's already done. Reassigning to me. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=367666 Peter Poeml changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=367666 User adrian@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=367666#c16 Adrian Schröter changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #16 from Adrian Schröter 2009-02-20 07:09:17 MST --- svn code of osc does support now kvm/xen builds. It does skip the verification in this case since the system gets secured by the VM. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.