<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Thanks for the reply Jeremy, but I
think your discussing the signing of packages as a whole, not the
signing of files within packages.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">I'm trying to learn a bit about how
Linux IMA works... <br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">The point of the feature is to have the
executable files within the package (deb or rpm) carry signatures
that the Linux kernel will validate before allowing the executable
to run.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">I'm still a little fuzzy on why the
signatures on the executables need to be injected as part of
packaging rather than building. Is that a requirement for the
chain of trust, or a conveniently centralized place to apply the
policy to all packages? And what does that mean for packages not
directly built by StarlingX?</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Perhaps it's moot.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">I'm pretty sure the IMA feature is not
currently supported within StarlingX. I'm hoping Greg can step in
and confirm.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Scott</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 2021-09-23 10:43 a.m., Jeremy
Stanley wrote:<br>
</div>
<blockquote type="cite" cite="mid:20210923144339.gnaeh3punbsvyylq@yuggoth.org">
<pre class="moz-quote-pre" wrap="">[Please note: This e-mail is from an EXTERNAL e-mail address]
On 2021-09-23 10:08:41 -0400 (-0400), Scott Little wrote:
[...]
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Do the Debian packaging tools need to support file signatures?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">[...]
In Debian more generally, packages (these days mainly just source
packages) are signed by their maintainers or uploaders as a sort of
authentication to the build and distribution infrastructure the
project maintains, but those signatures aren't really distributed to
package consumers and may be irrelevant to your effort. If you do
want to sign source packages and changes files at build time, you
can supply signing keys to any of the usual package build tools
(debuild, gbp, et cetera), but I wouldn't bother unless your
solution assumes that the rebuilders and indexers can't trust the
mechanisms by which those packages are moved between those systems.
It's important for Debian proper because they have thousands of
people uploading packages and they want to be sure the packages are
really from authorized individuals, but that's a lot different from
how StarlingX's packages are likely to be supplied.
The apt-secure(8) manpage on any modern Debian system explains the
consumer-facing archive signatures, which are over the package
indices instead of individual packages, as those include lists of
checksums for each package being distributed. Any time the set of
packages/versions within the archive changes, the index is
regenerated and signed again with the published archive key(s). This
is what users installing software from the distribution rely on to
be sure the packages they're getting are really the ones the
distribution is serving and that they haven't been tampered with in
transit. The package management tooling verifies the signatures on
package indices any time it updates them, and then relies on the
checksums included in each signed index to confirm a particular
package is authentic.
I have no idea how much of this is useful for you, but hopefully it
helps.
--
Jeremy Stanley
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Starlingx-discuss mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Starlingx-discuss@lists.starlingx.io">Starlingx-discuss@lists.starlingx.io</a>
<a class="moz-txt-link-freetext" href="http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss">http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss</a>
</pre>
</blockquote>
<p><br>
</p>
</body>
</html>