[Reproduce-devel] [task #15345] Automatically using backup tarball repository

[Boud Roukema]

Follow-up Comment #1, task #15345 (project reproduce):

Is it correct that as of commit da1123c, hashes to check tarball 
validity are only provided for python packages?


grep "h=" reproduce/software/make/*.mk


only finds the python hashes. I'd agree that python packages are
probably the most likely to be risky, although lower level routines
are at risk of having exploits too. Access to a user shell is a big 
step towards accessing root.

I think that a necessary element of automatically using backup tarballs 
would be having checksums for these. Using a mix of different URLs forces
the user to implicitly associate a primary trust/confidence value to the
individual or
group providing the overall package, since s/he won't be able to make
serious judgments on dozens of individual websites. This overlaps with the
general issue of "prefer-native-libraries" reproducibility
<https://cosmo.torun.pl/blog/reproducibility> versus exact reproducibility.
The more that goes through a
trusted community with fully transparent well-defined pipelines and
procedures
and decision making (such as Debian), the more trust the user can have in
software
being secure.
https://en.wikipedia.org/wiki/Web_of_trust
https://en.wikipedia.org/wiki/Computational_trust
https://en.wikipedia.org/wiki/Trust_(social_science%29
https://en.wikipedia.org/wiki/Computational_trust
(A quote from the last of those four articles: _"Computational Trust applies 
the human notion of trust to the digital world, that is seen as malicious
rather than
cooperative."_ I think that's fair enough, in the sense that crackers' robots,

and incompetent annoying robots, are very much real in cyberspace.)

The python checksums appear to have 64 hexadecimal characters, with two pairs
split off,
so my guess is that they're sha256sum checksums. Shifting to sha512sum would
probably be
safer (disclaimer: I'm not an encryption expert).

Anyway, my recommendation would be to, at least, have checksums for all
downloaded packages
that are not from the native distribution. A separate, though related, issue,
would be
to have some sort of systematic link to security alerts/updates. Again, this
is something
way beyond anything I'm experienced in.


    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/task/?15345>

_______________________________________________
  Message sent via Savannah
  https://savannah.nongnu.org/