From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Jean Louis Newsgroups: gmane.emacs.devel Subject: Re: Proposal to include obligatory PGP verification of packages from any repository Date: Tue, 20 Oct 2020 10:40:18 +0300 Message-ID: References: <20201019124335.GC19325@protected.rcdrun.com> <20201019163827.GG19325@protected.rcdrun.com> <20201019174745.GJ19325@protected.rcdrun.com> <20201019190452.GO19325@protected.rcdrun.com> <20201019210205.GT19325@protected.rcdrun.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="33057"; mail-complaints-to="usenet@ciao.gmane.io" User-Agent: Mutt/+ (1036f0e) (2020-10-18) Cc: "Philip K." , rms@gnu.org, thibaut.verron@gmail.com, mve1@runbox.com, emacs-devel@gnu.org, Stefan Kangas , Dmitry Gutov To: Stefan Monnier Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Thu Oct 22 18:56:29 2020 Return-path: Envelope-to: ged-emacs-devel@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kVdt7-0008UC-Mw for ged-emacs-devel@m.gmane-mx.org; Thu, 22 Oct 2020 18:56:29 +0200 Original-Received: from localhost ([::1]:44372 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kVdt6-0006gs-Ny for ged-emacs-devel@m.gmane-mx.org; Thu, 22 Oct 2020 12:56:28 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:60766) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kVdrs-0005sj-3a for emacs-devel@gnu.org; Thu, 22 Oct 2020 12:55:12 -0400 Original-Received: from static.rcdrun.com ([95.85.24.50]:37325) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kVdrq-0000Sf-2o; Thu, 22 Oct 2020 12:55:11 -0400 Original-Received: from localhost ([::ffff:41.202.241.51]) (AUTH: PLAIN admin, TLS: TLS1.2,256bits,ECDHE_RSA_AES_256_GCM_SHA384) by static.rcdrun.com with ESMTPSA id 00000000002A0B39.000000005F91B96B.000020FB; Thu, 22 Oct 2020 16:55:06 +0000 Content-Disposition: inline In-Reply-To: Received-SPF: pass client-ip=95.85.24.50; envelope-from=bugs@gnu.support; helo=static.rcdrun.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/10/22 12:49:00 X-ACL-Warn: Detected OS = Linux 3.11 and newer [fuzzy] X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.io gmane.emacs.devel:258314 Archived-At: * Stefan Monnier [2020-10-20 00:53]: > >> > Is there a policy that GNU ELPA packages should be signed? > >> Not sure what that would mean: *we* sign it, so there's no policy to > >> enforce. At most there are bugs to fix if the sigs are missing > >> or incorrect. > > It would be good to implement the policy. > > I don't know what that means (neither "the policy" nor "implement"). Rules of maintenance simply said: - that every request to any ELPA goes over SSL connection, to totally disable non-SSL connections to archives. Many countries spy on their citizens, and in many of those countries citizens are using encryption features, even it could be illegal to use encryption. By using non-SSL connection or allowing such, possibility is there that user get in danger of life. This is one very real example, it will look unreal to many who are in normal countries. I have a friend in such country. - that all packages are signed by default and that Emacs expects such by default There is set of principles for Emacs Lisp packaging in the info manual, those changes are only beneficial for future. Read on this link that Vasilij have presented to me yesterday: https://medium.com/hackernoon/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 That does happen. Research the report on this site: https://snyk.io/blog/javascript-frameworks-security-report-2019/ Compare insecurities on similar software package repositories with other languages to Emacs, and implement policies to prevent insecurities in future. To implement means in this context to follow through, follow up, follow out, carry out, implement, put through, go through -- pursue to a conclusion or bring to a successful issue; (Wordnet) there may be definitions in othe context. I speak of carrying out. Policy means a plan of action adopted by an individual or social group; "it was a policy of retribution"; "a politician keeps changing his policies" (Wordnet) -- there may be other definitons in other context, I speak of adopting plan of action for Emacs development. > >> > What I expect is a method for user to easily verify and know by which > >> > key was which package signed, such function should exist. > >> What does Debian do in this respect? > > There are ways to verify package authenticity, > > How? What does "package authenticity" mean? > Do you get to see which key signed which package? I skip this, I am sure you know it. > > Vasilij pointed out how it should be done. Verifications in Debian or > > Archlinux how I see it, happen in real time during installation and > > that is by default. > > Right, just as we do with GNU ELPA, AFAICT. It is not by default surprisingly to me. I had to turn on the option to have packages verified for signatures. > > So instead of using external gpg program, maybe you as developers > > could use gnutls library and that API to create signatures for > > packages in case that PGP/GnuPG cannot work. > > The problem is not to create signatures (which we do on our own machines > where we can easily make sure PGP is installed) but to verify them. Maybe gnutls offers that API, I cannot know technically, I could see the API is there. > >> - the signature system was introduced relatively shortly before it was > >> deployed for Emacs-24.4, so we did not want to break it for the other > >> ELPA archives. > > I understand and I find it unfortunate, and still suggest that it > > becomes enabled now, and not years there after. > > The current default made sense then. Maybe it should be changed > now, indeed. Thank you, Think about the growing number of: - users - developers - packages - fascism and varieties of oppression in the world Jean