[Starlingx-discuss] how to deal with loop dependent in building stage

[Scott Little]

Thanks for the reply Jeremy, but I think your discussing the signing of 
packages as a whole, not the signing of files within packages.

I'm trying to learn a bit about how Linux IMA works...

The point of the feature is to have the executable files within the 
package (deb or rpm) carry signatures that the Linux kernel will 
validate before allowing the executable to run.

I'm still a little fuzzy on why the signatures on the executables need 
to be injected as part of packaging rather than building.  Is that a 
requirement for the chain of trust, or a conveniently centralized place 
to apply the policy to all packages?  And what does that mean for 
packages not directly built by StarlingX?

Perhaps it's moot.

I'm pretty sure the IMA feature is not currently supported within 
StarlingX.  I'm hoping Greg can step in and confirm.

Scott


On 2021-09-23 10:43 a.m., Jeremy Stanley wrote:
> [Please note: This e-mail is from an EXTERNAL e-mail address]
>
> On 2021-09-23 10:08:41 -0400 (-0400), Scott Little wrote:
> [...]
>> Do the Debian packaging tools need to support file signatures?
> [...]
>
> In Debian more generally, packages (these days mainly just source
> packages) are signed by their maintainers or uploaders as a sort of
> authentication to the build and distribution infrastructure the
> project maintains, but those signatures aren't really distributed to
> package consumers and may be irrelevant to your effort. If you do
> want to sign source packages and changes files at build time, you
> can supply signing keys to any of the usual package build tools
> (debuild, gbp, et cetera), but I wouldn't bother unless your
> solution assumes that the rebuilders and indexers can't trust the
> mechanisms by which those packages are moved between those systems.
> It's important for Debian proper because they have thousands of
> people uploading packages and they want to be sure the packages are
> really from authorized individuals, but that's a lot different from
> how StarlingX's packages are likely to be supplied.
>
> The apt-secure(8) manpage on any modern Debian system explains the
> consumer-facing archive signatures, which are over the package
> indices instead of individual packages, as those include lists of
> checksums for each package being distributed. Any time the set of
> packages/versions within the archive changes, the index is
> regenerated and signed again with the published archive key(s). This
> is what users installing software from the distribution rely on to
> be sure the packages they're getting are really the ones the
> distribution is serving and that they haven't been tampered with in
> transit. The package management tooling verifies the signatures on
> package indices any time it updates them, and then relies on the
> checksums included in each signed index to confirm a particular
> package is authentic.
>
> I have no idea how much of this is useful for you, but hopefully it
> helps.
> --
> Jeremy Stanley
>
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20210923/96a0c70e/attachment.htm>