* bug#40316: Core updates status
[not found] ` <quwzpv6nqevtbdp2galghxgx3x23zmsppmm6gcmpj3siqrrbud@r27tt6htlol3>
@ 2024-04-25 14:06 ` Christina O'Donnell
0 siblings, 0 replies; only message in thread
From: Christina O'Donnell @ 2024-04-25 14:06 UTC (permalink / raw)
To: 40316; +Cc: guix-devel, Steve George
Hi Steve,
> It would be good to confirm this one:
>
> https://debbugs.gnu.org/cgi/bugreport.cgi?bug=40316
Still fails to reproduce with those changes applied.
The culprit is in nss/cmd/shlibsign/shlibsign.c:
shlibSignHMAC generates a new key-pair each time it's run:
/* Generate a DSA key pair */
logIt("Generate an HMAC key ... \n");
crv = pFunctionList->C_GenerateKey(hRwSession, &hmacKeyGenMech,
hmacKeyTemplate,
PR_ARRAY_SIZE(hmacKeyTemplate),
&hHMACKey);
Three options:
1. Disable library signing entirely.
2. Seed the generation to be deterministic.
3. Drop in a HMAC key-pair and patch the code to use that instead of
generating.
2 and 3 defeat the point of the cryptographically secure supply chain as
the private key can be obtained deterministically, so my vote would be
simply to not sign the libraries (1), which would be easier to
maintain. We're not the primary distributor and users can verify our
distribution of nss by running `guix challenge` anyway.
> It looks like Zhen Junjie applied two patches to fix NSS cross-compilation on Master [0]
Building everything cross-compiled to ARM now.
Kind regards,
Christina
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2024-04-25 15:59 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <Ziihyt5dYdvv_fRR@dragon2>
[not found] ` <451a97f9-0e16-c1b3-8884-52420e265db3@mutix.org>
[not found] ` <quwzpv6nqevtbdp2galghxgx3x23zmsppmm6gcmpj3siqrrbud@r27tt6htlol3>
2024-04-25 14:06 ` bug#40316: Core updates status Christina O'Donnell
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).