<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:windowtext">Correct, IMA is not supported in StarlingX.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">Greg.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:windowtext">From:</span></b><span style="color:windowtext"> Scott Little <scott.little@windriver.com>
<br>
<b>Sent:</b> Thursday, September 23, 2021 11:14 AM<br>
<b>To:</b> starlingx-discuss@lists.starlingx.io<br>
<b>Subject:</b> Re: [Starlingx-discuss] how to deal with loop dependent in building stage<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Thanks for the reply Jeremy, but I think your discussing the signing of packages as a whole, not the signing of files within packages.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm trying to learn a bit about how Linux IMA works... <o:p>
</o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The point of the feature is to have the executable files within the package (deb or rpm) carry signatures that the Linux kernel will validate before allowing the executable to run.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm still a little fuzzy on why the signatures on the executables need to be injected as part of packaging rather than building. Is that a requirement for the chain of trust, or a conveniently centralized place to apply the policy to all
packages? And what does that mean for packages not directly built by StarlingX?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Perhaps it's moot.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm pretty sure the IMA feature is not currently supported within StarlingX. I'm hoping Greg can step in and confirm.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Scott<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On 2021-09-23 10:43 a.m., Jeremy Stanley wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre>[Please note: This e-mail is from an EXTERNAL e-mail address]<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>On 2021-09-23 10:08:41 -0400 (-0400), Scott Little wrote:<o:p></o:p></pre>
<pre>[...]<o:p></o:p></pre>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre>Do the Debian packaging tools need to support file signatures?<o:p></o:p></pre>
</blockquote>
<pre>[...]<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>In Debian more generally, packages (these days mainly just source<o:p></o:p></pre>
<pre>packages) are signed by their maintainers or uploaders as a sort of<o:p></o:p></pre>
<pre>authentication to the build and distribution infrastructure the<o:p></o:p></pre>
<pre>project maintains, but those signatures aren't really distributed to<o:p></o:p></pre>
<pre>package consumers and may be irrelevant to your effort. If you do<o:p></o:p></pre>
<pre>want to sign source packages and changes files at build time, you<o:p></o:p></pre>
<pre>can supply signing keys to any of the usual package build tools<o:p></o:p></pre>
<pre>(debuild, gbp, et cetera), but I wouldn't bother unless your<o:p></o:p></pre>
<pre>solution assumes that the rebuilders and indexers can't trust the<o:p></o:p></pre>
<pre>mechanisms by which those packages are moved between those systems.<o:p></o:p></pre>
<pre>It's important for Debian proper because they have thousands of<o:p></o:p></pre>
<pre>people uploading packages and they want to be sure the packages are<o:p></o:p></pre>
<pre>really from authorized individuals, but that's a lot different from<o:p></o:p></pre>
<pre>how StarlingX's packages are likely to be supplied.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>The apt-secure(8) manpage on any modern Debian system explains the<o:p></o:p></pre>
<pre>consumer-facing archive signatures, which are over the package<o:p></o:p></pre>
<pre>indices instead of individual packages, as those include lists of<o:p></o:p></pre>
<pre>checksums for each package being distributed. Any time the set of<o:p></o:p></pre>
<pre>packages/versions within the archive changes, the index is<o:p></o:p></pre>
<pre>regenerated and signed again with the published archive key(s). This<o:p></o:p></pre>
<pre>is what users installing software from the distribution rely on to<o:p></o:p></pre>
<pre>be sure the packages they're getting are really the ones the<o:p></o:p></pre>
<pre>distribution is serving and that they haven't been tampered with in<o:p></o:p></pre>
<pre>transit. The package management tooling verifies the signatures on<o:p></o:p></pre>
<pre>package indices any time it updates them, and then relies on the<o:p></o:p></pre>
<pre>checksums included in each signed index to confirm a particular<o:p></o:p></pre>
<pre>package is authentic.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>I have no idea how much of this is useful for you, but hopefully it<o:p></o:p></pre>
<pre>helps.<o:p></o:p></pre>
<pre>--<o:p></o:p></pre>
<pre>Jeremy Stanley<o:p></o:p></pre>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>Starlingx-discuss mailing list<o:p></o:p></pre>
<pre><a href="mailto:Starlingx-discuss@lists.starlingx.io">Starlingx-discuss@lists.starlingx.io</a><o:p></o:p></pre>
<pre><a href="https://urldefense.com/v3/__http:/lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss__;!!AjveYdw8EvQ!PLgEuvehtMaSlbjG9M_B5XUJRDFWNa6G-BTL2umbfcHz5qTq27RNcsTY4SIWdWTbSPs$">http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss</a><o:p></o:p></pre>
</blockquote>
<p><o:p> </o:p></p>
</div>
</body>
</html>