From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id KMMrJdKz3l43awAA0tVLHw (envelope-from ) for ; Mon, 08 Jun 2020 21:55:30 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2 with LMTPS id 4AslIdKz3l6jMAAAB5/wlQ (envelope-from ) for ; Mon, 08 Jun 2020 21:55:30 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 0D2D5940308 for ; Mon, 8 Jun 2020 21:55:30 +0000 (UTC) Received: from localhost ([::1]:45214 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jiPjt-0004pN-0B for larch@yhetil.org; Mon, 08 Jun 2020 17:55:29 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:50348) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jiPjU-0004Y7-JD for bug-guix@gnu.org; Mon, 08 Jun 2020 17:55:04 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:46566) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jiPjU-0008CL-7g for bug-guix@gnu.org; Mon, 08 Jun 2020 17:55:04 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1jiPjU-0006Wl-6z; Mon, 08 Jun 2020 17:55:04 -0400 X-Loop: help-debbugs@gnu.org Subject: bug#22883: [PATCH 4/9] channels: 'latest-channel-instance' authenticates Git checkouts. Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Mon, 08 Jun 2020 21:55:04 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 22883 X-GNU-PR-Package: guix X-GNU-PR-Keywords: security To: 22883@debbugs.gnu.org Received: via spool by 22883-submit@debbugs.gnu.org id=B22883.159165329524993 (code B ref 22883); Mon, 08 Jun 2020 21:55:04 +0000 Received: (at 22883) by debbugs.gnu.org; 8 Jun 2020 21:54:55 +0000 Received: from localhost ([127.0.0.1]:58093 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1jiPjK-0006Uw-9L for submit@debbugs.gnu.org; Mon, 08 Jun 2020 17:54:55 -0400 Received: from eggs.gnu.org ([209.51.188.92]:42180) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1jiPjH-0006Tj-48 for 22883@debbugs.gnu.org; Mon, 08 Jun 2020 17:54:51 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:57659) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jiPjB-00082p-QQ; Mon, 08 Jun 2020 17:54:45 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=56818 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1jiPjB-0007OP-1g; Mon, 08 Jun 2020 17:54:45 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Mon, 8 Jun 2020 23:54:10 +0200 Message-Id: <20200608215415.2871-4-ludo@gnu.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200608215415.2871-1-ludo@gnu.org> References: <20200608215415.2871-1-ludo@gnu.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-Spam-Score: -3.3 (---) X-BeenThere: bug-guix@gnu.org List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+larch=yhetil.org@gnu.org Sender: "bug-Guix" X-Scanner: scn0 Authentication-Results: aspmx1.migadu.com; dkim=none; dmarc=none; spf=pass (aspmx1.migadu.com: domain of bug-guix-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=bug-guix-bounces@gnu.org X-Spam-Score: 3.99 X-TUID: Hsg7StQZu66j Fixes . * guix/channels.scm ()[introduction]: New field. (): New record type. (%guix-channel-introduction): New variable. (%default-channels): Use it. ()[keyring-reference]: New field. (%default-keyring-reference): New variable. (read-channel-metadata, read-channel-metadata-from-source): Initialize the 'keyring-reference' field. (commit-short-id, verify-introductory-commit) (authenticate-channel): New procedures. (latest-channel-instance): Call 'authenticate-channel' when CHANNEL has an introduction. * tests/channels.scm (gpg+git-available?, commit-id-string): New procedures. ("authenticate-channel, wrong first commit signer"): ("authenticate-channel, .guix-authorizations"): New tests. * doc/guix.texi (Invoking guix pull): Mention authentication. --- .dir-locals.el | 1 + doc/guix.texi | 6 +- guix/channels.scm | 182 +++++++++++++++++++++++++++++++++++++++++++-- tests/channels.scm | 122 ++++++++++++++++++++++++++++++ 4 files changed, 304 insertions(+), 7 deletions(-) diff --git a/.dir-locals.el b/.dir-locals.el index dc8bc0e437..7ac1eb7509 100644 --- a/.dir-locals.el +++ b/.dir-locals.el @@ -95,6 +95,7 @@ (eval . (put 'eventually 'scheme-indent-function 1)) (eval . (put 'call-with-progress-reporter 'scheme-indent-function 1)) + (eval . (put 'with-repository 'scheme-indent-function 2)) (eval . (put 'with-temporary-git-repository 'scheme-indent-function 2)) (eval . (put 'with-environment-variables 'scheme-indent-function 1)) (eval . (put 'with-fresh-gnupg-setup 'scheme-indent-function 1)) diff --git a/doc/guix.texi b/doc/guix.texi index 056bf011f6..6fcb47970b 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -3719,13 +3719,17 @@ this option is primarily useful when the daemon was running with @cindex updating Guix @cindex @command{guix pull} @cindex pull +@cindex security, @command{guix pull} +@cindex authenticity, of code obtained with @command{guix pull} Packages are installed or upgraded to the latest version available in the distribution currently available on your local machine. To update that distribution, along with the Guix tools, you must run @command{guix pull}: the command downloads the latest Guix source code and package descriptions, and deploys it. Source code is downloaded from a @uref{https://git-scm.com, Git} repository, by default the official -GNU@tie{}Guix repository, though this can be customized. +GNU@tie{}Guix repository, though this can be customized. @command{guix +pull} ensures that the code it downloads is @emph{authentic} by +verifying that commits are signed by Guix developers. Specifically, @command{guix pull} downloads code from the @dfn{channels} (@pxref{Channels}) specified by one of the followings, in this order: diff --git a/guix/channels.scm b/guix/channels.scm index 84c47fc0d0..c2ea0e26ff 100644 --- a/guix/channels.scm +++ b/guix/channels.scm @@ -21,6 +21,11 @@ (define-module (guix channels) #:use-module (git) #:use-module (guix git) + #:use-module (guix git-authenticate) + #:use-module ((guix openpgp) + #:select (openpgp-public-key-fingerprint + openpgp-format-fingerprint)) + #:use-module (guix base16) #:use-module (guix records) #:use-module (guix gexp) #:use-module (guix modules) @@ -28,6 +33,7 @@ #:use-module (guix monads) #:use-module (guix profiles) #:use-module (guix packages) + #:use-module (guix progress) #:use-module (guix derivations) #:use-module (guix combinators) #:use-module (guix diagnostics) @@ -48,17 +54,23 @@ #:autoload (guix self) (whole-package make-config.scm) #:autoload (guix inferior) (gexp->derivation-in-inferior) ;FIXME: circular dep #:autoload (guix quirks) (%quirks %patches applicable-patch? apply-patch) + #:use-module (ice-9 format) #:use-module (ice-9 match) #:use-module (ice-9 vlist) #:use-module ((ice-9 rdelim) #:select (read-string)) + #:use-module ((rnrs bytevectors) #:select (bytevector=?)) #:export (channel channel? channel-name channel-url channel-branch channel-commit + channel-introduction channel-location + channel-introduction? + ;; accessors purposefully omitted for now. + %default-channels guix-channel? @@ -67,6 +79,7 @@ channel-instance-commit channel-instance-checkout + authenticate-channel latest-channel-instances checkout->channel-instance latest-channel-derivation @@ -104,15 +117,44 @@ (url channel-url) (branch channel-branch (default "master")) (commit channel-commit (default #f)) + (introduction channel-introduction (default #f)) (location channel-location (default (current-source-location)) (innate))) +;; Channel introductions. A "channel introduction" provides a commit/signer +;; pair that specifies the first commit of the authentication process as well +;; as its signer's fingerprint. The pair must be signed by the signer of that +;; commit so that only them may emit this introduction. Introductions are +;; used to bootstrap trust in a channel. +(define-record-type + (make-channel-introduction first-signed-commit first-commit-signer + signature) + channel-introduction? + (first-signed-commit channel-introduction-first-signed-commit) ;hex string + (first-commit-signer channel-introduction-first-commit-signer) ;bytevector + (signature channel-introduction-signature)) ;string + +(define %guix-channel-introduction + ;; Introduction of the official 'guix channel. The chosen commit is the + ;; first one that introduces '.guix-authorizations' on the 'core-updates' + ;; branch that was eventually merged in 'master'. Any branch starting + ;; before that commit cannot be merged or it will be rejected by 'guix pull' + ;; & co. + (make-channel-introduction + "87a40d7203a813921b3ef0805c2b46c0026d6c31" + (base16-string->bytevector + (string-downcase + (string-filter char-set:hex-digit ;mbakke + "BBB0 2DDF 2CEA F6A8 0D1D E643 A2A0 6DF2 A33A 54FA"))) + #f)) ;TODO: Add an intro signature so it can be exported. + (define %default-channels ;; Default list of channels. (list (channel (name 'guix) (branch "master") - (url "https://git.savannah.gnu.org/git/guix.git")))) + (url "https://git.savannah.gnu.org/git/guix.git") + (introduction %guix-channel-introduction)))) (define (guix-channel? channel) "Return true if CHANNEL is the 'guix' channel." @@ -126,11 +168,16 @@ (checkout channel-instance-checkout)) (define-record-type - (channel-metadata directory dependencies news-file) + (channel-metadata directory dependencies news-file keyring-reference) channel-metadata? (directory channel-metadata-directory) ;string with leading slash (dependencies channel-metadata-dependencies) ;list of - (news-file channel-metadata-news-file)) ;string | #f + (news-file channel-metadata-news-file) ;string | #f + (keyring-reference channel-metadata-keyring-reference)) ;string + +(define %default-keyring-reference + ;; Default value of the 'keyring-reference' field. + "keyring") (define (channel-reference channel) "Return the \"reference\" for CHANNEL, an sexp suitable for @@ -147,7 +194,10 @@ if valid metadata could not be read from PORT." (('channel ('version 0) properties ...) (let ((directory (and=> (assoc-ref properties 'directory) first)) (dependencies (or (assoc-ref properties 'dependencies) '())) - (news-file (and=> (assoc-ref properties 'news-file) first))) + (news-file (and=> (assoc-ref properties 'news-file) first)) + (keyring-reference + (or (and=> (assoc-ref properties 'keyring-reference) first) + %default-keyring-reference))) (channel-metadata (cond ((not directory) "/") ;directory ((string-prefix? "/" directory) directory) @@ -164,7 +214,8 @@ if valid metadata could not be read from PORT." (url url) (commit (get 'commit)))))) dependencies) - news-file))) ;news-file + news-file + keyring-reference))) ((and ('channel ('version version) _ ...) sexp) (raise (condition (&message (message "unsupported '.guix-channel' version")) @@ -188,7 +239,7 @@ doesn't exist." read-channel-metadata)) (lambda args (if (= ENOENT (system-error-errno args)) - (channel-metadata "/" '() #f) + (channel-metadata "/" '() #f %default-keyring-reference) (apply throw args))))) (define (channel-instance-metadata instance) @@ -212,6 +263,117 @@ result is unspecified." (apply-patch patch checkout)) (loop rest))))) +(define commit-short-id + (compose (cut string-take <> 7) oid->string commit-id)) + +(define (verify-introductory-commit repository introduction keyring) + "Raise an exception if the first commit described in INTRODUCTION doesn't +have the expected signer." + (define commit-id + (channel-introduction-first-signed-commit introduction)) + + (define actual-signer + (openpgp-public-key-fingerprint + (commit-signing-key repository (string->oid commit-id) + keyring))) + + (define expected-signer + (channel-introduction-first-commit-signer introduction)) + + (unless (bytevector=? expected-signer actual-signer) + (raise (condition + (&message + (message (format #f (G_ "initial commit ~a is signed by '~a' \ +instead of '~a'") + commit-id + (openpgp-format-fingerprint actual-signer) + (openpgp-format-fingerprint expected-signer)))))))) + +(define* (authenticate-channel channel checkout commit + #:key (keyring-reference-prefix "origin/")) + "Authenticate the given COMMIT of CHANNEL, available at CHECKOUT, a +directory containing a CHANNEL checkout. Raise an error if authentication +fails." + ;; XXX: Too bad we need to re-open CHECKOUT. + (with-repository checkout repository + (define start-commit + (commit-lookup repository + (string->oid + (channel-introduction-first-signed-commit + (channel-introduction channel))))) + + (define end-commit + (commit-lookup repository (string->oid commit))) + + (define cache-key + (string-append "channels/" (symbol->string (channel-name channel)))) + + (define keyring-reference + (channel-metadata-keyring-reference + (read-channel-metadata-from-source checkout))) + + (define keyring + (load-keyring-from-reference repository + (string-append keyring-reference-prefix + keyring-reference))) + + (define authenticated-commits + ;; Previously-authenticated commits that don't need to be checked again. + (filter-map (lambda (id) + (false-if-exception + (commit-lookup repository (string->oid id)))) + (previously-authenticated-commits cache-key))) + + (define commits + ;; Commits to authenticate, excluding the closure of + ;; AUTHENTICATED-COMMITS. + (commit-difference end-commit start-commit + authenticated-commits)) + + (define reporter + (progress-reporter/bar (length commits))) + + ;; When COMMITS is empty, it's either because AUTHENTICATED-COMMITS + ;; contains END-COMMIT or because END-COMMIT is not a descendant of + ;; START-COMMIT. Check that. + (if (null? commits) + (match (commit-relation start-commit end-commit) + ((or 'self 'ancestor 'descendant) #t) ;nothing to do! + ('unrelated + (raise + (condition + (&message + (message + (format #f (G_ "'~a' is not related to introductory \ +commit of channel '~a'~%") + (oid->string (commit-id end-commit)) + (channel-name channel)))))))) + (begin + (format (current-error-port) + (G_ "Authenticating channel '~a', \ +commits ~a to ~a (~h new commits)...~%") + (channel-name channel) + (commit-short-id start-commit) + (commit-short-id end-commit) + (length commits)) + + ;; If it's our first time, verify CHANNEL's introductory commit. + (when (null? authenticated-commits) + (verify-introductory-commit repository + (channel-introduction channel) + keyring)) + + (call-with-progress-reporter reporter + (lambda (report) + (authenticate-commits repository commits + #:keyring keyring + #:report-progress report))) + + (unless (null? commits) + (cache-authenticated-commit cache-key + (oid->string + (commit-id end-commit)))))))) + (define* (latest-channel-instance store channel #:key (patches %patches) starting-commit) @@ -225,6 +387,14 @@ relation to STARTING-COMMIT when provided." (update-cached-checkout (channel-url channel) #:ref (channel-reference channel) #:starting-commit starting-commit))) + (if (channel-introduction channel) + (authenticate-channel channel checkout commit) + ;; TODO: Warn for all the channels once the authentication interface + ;; is public. + (when (guix-channel? channel) + (warning (G_ "the code of channel '~a' cannot be authenticated~%") + (channel-name channel)))) + (when (guix-channel? channel) ;; Apply the relevant subset of PATCHES directly in CHECKOUT. This is ;; safe to do because 'switch-to-ref' eventually does a hard reset. diff --git a/tests/channels.scm b/tests/channels.scm index 3b141428c8..2c857083e9 100644 --- a/tests/channels.scm +++ b/tests/channels.scm @@ -31,15 +31,28 @@ #:use-module ((guix build utils) #:select (which)) #:use-module (git) #:use-module (guix git) + #:use-module (guix git-authenticate) + #:use-module (guix openpgp) #:use-module (guix tests git) + #:use-module (guix tests gnupg) #:use-module (srfi srfi-1) #:use-module (srfi srfi-26) #:use-module (srfi srfi-34) #:use-module (srfi srfi-35) #:use-module (srfi srfi-64) + #:use-module (rnrs bytevectors) + #:use-module (rnrs io ports) #:use-module (ice-9 control) #:use-module (ice-9 match)) +(define (gpg+git-available?) + (and (which (git-command)) + (which (gpg-command)) (which (gpgconf-command)))) + +(define commit-id-string + (compose oid->string commit-id)) + + (test-begin "channels") (define* (make-instance #:key @@ -389,4 +402,113 @@ (channel-news-for-commit channel commit5 commit1)) '(#f "tag-for-first-news-entry"))))))) +(unless (gpg+git-available?) (test-skip 1)) +(test-assert "authenticate-channel, wrong first commit signer" + (with-fresh-gnupg-setup (list %ed25519-public-key-file + %ed25519-secret-key-file + %ed25519bis-public-key-file + %ed25519bis-secret-key-file) + (with-temporary-git-repository directory + `((add ".guix-channel" + ,(object->string + '(channel (version 0) + (keyring-reference "master")))) + (add ".guix-authorizations" + ,(object->string + `(authorizations (version 0) + ((,(key-fingerprint + %ed25519-public-key-file) + (name "Charlie")))))) + (add "signer.key" ,(call-with-input-file %ed25519-public-key-file + get-string-all)) + (commit "first commit" + (signer ,(key-fingerprint %ed25519-public-key-file)))) + (with-repository directory repository + (let* ((commit1 (find-commit repository "first")) + (intro ((@@ (guix channels) make-channel-introduction) + (commit-id-string commit1) + (openpgp-public-key-fingerprint + (read-openpgp-packet + %ed25519bis-public-key-file)) ;different key + #f)) ;no signature + (channel (channel (name 'example) + (url (string-append "file://" directory)) + (introduction intro)))) + (guard (c ((message? c) + (->bool (string-contains (condition-message c) + "initial commit")))) + (authenticate-channel channel directory + (commit-id-string commit1) + #:keyring-reference-prefix "") + 'failed)))))) + +(unless (gpg+git-available?) (test-skip 1)) +(test-assert "authenticate-channel, .guix-authorizations" + (with-fresh-gnupg-setup (list %ed25519-public-key-file + %ed25519-secret-key-file + %ed25519bis-public-key-file + %ed25519bis-secret-key-file) + (with-temporary-git-repository directory + `((add ".guix-channel" + ,(object->string + '(channel (version 0) + (keyring-reference "channel-keyring")))) + (add ".guix-authorizations" + ,(object->string + `(authorizations (version 0) + ((,(key-fingerprint + %ed25519-public-key-file) + (name "Charlie")))))) + (commit "zeroth commit") + (add "a.txt" "A") + (commit "first commit" + (signer ,(key-fingerprint %ed25519-public-key-file))) + (add "b.txt" "B") + (commit "second commit" + (signer ,(key-fingerprint %ed25519-public-key-file))) + (add "c.txt" "C") + (commit "third commit" + (signer ,(key-fingerprint %ed25519bis-public-key-file))) + (branch "channel-keyring") + (checkout "channel-keyring") + (add "signer.key" ,(call-with-input-file %ed25519-public-key-file + get-string-all)) + (add "other.key" ,(call-with-input-file %ed25519bis-public-key-file + get-string-all)) + (commit "keyring commit") + (checkout "master")) + (with-repository directory repository + (let* ((commit1 (find-commit repository "first")) + (commit2 (find-commit repository "second")) + (commit3 (find-commit repository "third")) + (intro ((@@ (guix channels) make-channel-introduction) + (commit-id-string commit1) + (openpgp-public-key-fingerprint + (read-openpgp-packet + %ed25519-public-key-file)) + #f)) ;no signature + (channel (channel (name 'example) + (url (string-append "file://" directory)) + (introduction intro)))) + ;; COMMIT1 and COMMIT2 are fine. + (and (authenticate-channel channel directory + (commit-id-string commit2) + #:keyring-reference-prefix "") + + ;; COMMIT3 is signed by an unauthorized key according to its + ;; parent's '.guix-authorizations' file. + (guard (c ((unauthorized-commit-error? c) + (and (oid=? (git-authentication-error-commit c) + (commit-id commit3)) + (bytevector=? + (openpgp-public-key-fingerprint + (unauthorized-commit-error-signing-key c)) + (openpgp-public-key-fingerprint + (read-openpgp-packet + %ed25519bis-public-key-file)))))) + (authenticate-channel channel directory + (commit-id-string commit3) + #:keyring-reference-prefix "") + 'failed))))))) + (test-end "channels") -- 2.26.2