[Bug 461957] New: Please make available the PGP key IDs on a non wiki web page
https://bugzilla.novell.com/show_bug.cgi?id=461957 Summary: Please make available the PGP key IDs on a non wiki web page Product: openSUSE 11.1 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: Security AssignedTo: security-team@suse.de ReportedBy: robin.listas@telefonica.net QAContact: qa@suse.de CC: pth@novell.com Found By: --- The PGP keys used for signing packages available for opensuse, including those of Novell and of the buildservice should be available on a web page, and that one be a non wiki page. At least the IDs and the fingerprint of the keys. And this web page should be referred to by zypper. Why? Because we can download the keys (for instance, the "openSUSE Project Signing Key") from a public pgp key server, but we do not know if that key we download is the real one or a fake: we must have a web of trust. We must have a method to verify and sign keys, knowing that we do have the real, good, keys. And of course, keys must be signed by a master key, forming a web of trust. The current method of having zypper automatically download keys and accept them permanently, without a known method of verifying if that is the key of that repo, offers no real security - IMO. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=461957 User meissner@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=461957#c1 --- Comment #1 from Marcus Meissner <meissner@novell.com> 2008-12-31 04:09:41 MST --- i actually tried to make yast better, but so far had no good ideas. If you ideas for YAST please speak up too. I will see what we can do with publishing the signatures. Perhaps we can attach them to the security advisories and the security signature page. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=461957 User robin.listas@telefonica.net added comment https://bugzilla.novell.com/show_bug.cgi?id=461957#c2 --- Comment #2 from Carlos Robinson <robin.listas@telefonica.net> 2008-12-31 05:40:05 MST --- My suggestion is that Yast or zypper, when they ask about importing a key, should list all the information they have about a key, and suggest visiting a certain web page at openSUSE where the list of keys IDs and names is listed. If the key with certain name has a different ID to the one that zypper offers to add to the ring, then we know the key is false. That's the first step, the one this report is about. That web page can not be a wiki, or at least, not a public one. On the other hand, a module could be added to zypper/yast to handle pgp keys, but it could simply be calling one of the desktop key handlers, like seahorse, with the appropriate options. There the user could check the web of trust, import keys, etc. As it it a keyring separate from that of the user or root, it can not be handled directly. And of course, keys have to be inter-signed. When the admin finishes importing keys in the external app, he can tell zypper/yast to retry, abort, continue... Another possible feature is yast/zypper listing the "trust" level of keys associated to repos when displaying repos. It could be an entire set of new options for zypper. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com