From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id wMOKBbZTrF4JSQAA0tVLHw (envelope-from ) for ; Fri, 01 May 2020 16:52:06 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1 with LMTPS id UN4uAsBTrF7KNAAAbx9fmQ (envelope-from ) for ; Fri, 01 May 2020 16:52:16 +0000 Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:470:142::17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 42143941B49 for ; Fri, 1 May 2020 16:52:14 +0000 (UTC) Received: from localhost ([::1]:56088 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jUYta-0006u7-E6 for larch@yhetil.org; Fri, 01 May 2020 12:52:14 -0400 Received: from eggs.gnu.org ([209.51.188.92]:55108) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jUYtP-0006rp-W8 for bug-guix@gnu.org; Fri, 01 May 2020 12:52:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.90_1) (envelope-from ) id 1jUYtO-0005xF-W4 for bug-guix@gnu.org; Fri, 01 May 2020 12:52:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:38994) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jUYtO-0005vo-IE for bug-guix@gnu.org; Fri, 01 May 2020 12:52:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1jUYtO-0006mP-GY; Fri, 01 May 2020 12:52:02 -0400 X-Loop: help-debbugs@gnu.org Subject: bug#22883: Authenticating a Git checkout Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: bug-guix@gnu.org Resent-Date: Fri, 01 May 2020 16:52:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 22883 X-GNU-PR-Package: guix X-GNU-PR-Keywords: security To: Justus Winter Received: via spool by 22883-submit@debbugs.gnu.org id=B22883.158835186225962 (code B ref 22883); Fri, 01 May 2020 16:52:02 +0000 Received: (at 22883) by debbugs.gnu.org; 1 May 2020 16:51:02 +0000 Received: from localhost ([127.0.0.1]:50534 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1jUYsP-0006kc-R3 for submit@debbugs.gnu.org; Fri, 01 May 2020 12:51:02 -0400 Received: from eggs.gnu.org ([209.51.188.92]:51336) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1jUYsO-0006kH-Cp for 22883@debbugs.gnu.org; Fri, 01 May 2020 12:51:00 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:59578) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jUYsI-0004Vr-69; Fri, 01 May 2020 12:50:54 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=41126 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1jUYsH-0001V1-LX; Fri, 01 May 2020 12:50:54 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= References: <87io14sqoa.fsf@dustycloud.org> <87h9ep8gxk.fsf@gnu.org> <20160426001359.GA23088@jasmine> <874majg0z8.fsf@gnu.org> <87bn3iz1xc.fsf_-_@gnu.org> <87wpket748.fsf@gnu.org> <87bmkwm8ed.fsf@gnu.org> <87png9o8i2.fsf@elephly.net> <87fth4bj6y.fsf@gnu.org> <87bln9oupo.fsf@gnu.org> <87sggjpsit.fsf@europa.jade-hamburg.de> Date: Fri, 01 May 2020 18:50:51 +0200 In-Reply-To: <87sggjpsit.fsf@europa.jade-hamburg.de> (Justus Winter's message of "Fri, 01 May 2020 17:46:34 +0200") Message-ID: <87pnbnha50.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-Received-From: 209.51.188.43 X-BeenThere: bug-guix@gnu.org List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: 22883@debbugs.gnu.org Errors-To: bug-guix-bounces+larch=yhetil.org@gnu.org Sender: "bug-Guix" X-Scanner: scn0 X-Spam-Score: 1.11 Authentication-Results: aspmx1.migadu.com; dkim=none; dmarc=none; spf=pass (aspmx1.migadu.com: domain of bug-guix-bounces@gnu.org designates 2001:470:142::17 as permitted sender) smtp.mailfrom=bug-guix-bounces@gnu.org X-Scan-Result: default: False [1.11 / 13.00]; RCVD_VIA_SMTP_AUTH(0.00)[]; GENERIC_REPUTATION(0.00)[-0.4953953750327]; MX_INVALID(1.00)[cached]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip6:2001:470:142::/48:c]; IP_REPUTATION_HAM(0.00)[asn: 22989(0.16), country: US(-0.00), ip: 2001:470:142::17(-0.50)]; DWL_DNSWL_FAIL(0.00)[2001:470:142::17:server fail]; RCPT_COUNT_TWO(0.00)[2]; MAILLIST(-0.20)[mailman]; FORGED_RECIPIENTS_MAILLIST(0.00)[]; MIME_TRACE(0.00)[0:+]; R_MIXED_CHARSET(0.63)[subject]; ASN(0.00)[asn:22989, ipnet:2001:470:142::/48, country:US]; R_DKIM_NA(0.00)[]; TAGGED_FROM(0.00)[larch=yhetil.org]; ARC_NA(0.00)[]; FROM_NEQ_ENVFROM(0.00)[ludo@gnu.org,bug-guix-bounces@gnu.org]; FROM_HAS_DN(0.00)[]; URIBL_BLOCKED(0.00)[sequoia-pgp.org:email,gnu.org:email]; MID_RHS_MATCH_FROM(0.00)[]; MIME_GOOD(-0.10)[text/plain]; RCVD_TLS_LAST(0.00)[]; DMARC_NA(0.00)[gnu.org]; HAS_LIST_UNSUB(-0.01)[]; DNSWL_BLOCKED(0.00)[2001:470:142::17:from]; RCVD_COUNT_SEVEN(0.00)[10]; FORGED_SENDER_MAILLIST(0.00)[] X-TUID: eJwsoKRehbr0 Hi Justus, Justus Winter skribis: > Ludovic Court=C3=A8s writes: [...] >> Signature verification in (guix openpgp) does just that: signature >> verification. It does not validate signature and key metadata, in >> particular expiration date. I guess it should at least error out when a >> signature creation time is newer than its key expiration time. > > Indeed. I skimmed both the original and the adapted code, and it > notably does no attempt to canonicalize the certificates in the keyring > (i.e. checking binding signatures, lifetimes, revocations, (sub)key > flags...). While that is a bit dangerous, it is okay for a point > solution for Guix, provided that this is properly documented and > communicated. > > One can forgo canonicalization if one assumes that the keyring is > curated, and one has a good-list of (sub)keys fingerprints that are > allowed to create signatures. Reading git-authentiate.scm that does > seem to be the case. Yeah, the (guix openpgp) module is good enough for this narrow use case, but I agree that people shouldn=E2=80=99t view it as a viable signature-only OpenPGP implementation in the general case. I=E2=80=99ll clarify this at least in the source file. > (I bet that certificate canonicalization is the major reason why calling > out to gpgv is so slow: it does that every time, and it involves > signature verification, which is slow (yes, I'm looking at you, RSA).) I see. >> It should also reject SHA1 signatures, at least optionally (I haven=E2= =80=99t >> checked whether our Git history has any of these). > > I believe it should. For reference, we reject SHA1 signatures for > signatures created since 2013. Sounds good, I=E2=80=99ll do that. >> Next steps: >> >> =E2=80=A2 Clean up the (guix openpgp) API a bit, for instance by using= proper >> SRFI-35 error conditions. Perhaps handle v5 packets too. > > Don't bother with v5 packets for now. The RFC is nowhere near > completion, and even if it is one day, it will be quite some time until > you see these packets in the wild. Alright, even better. Thanks for taking the time to look into it! Ludo=E2=80=99.