unofficial mirror of guix-devel@gnu.org 
 help / color / mirror / code / Atom feed
From: Tobias Geerinckx-Rice <me@tobias.gr>
To: Arun Isaac <arunisaac@systemreboot.net>
Cc: guix-devel@gnu.org
Subject: Re: Public guix offload server
Date: Wed, 20 Oct 2021 23:06:05 +0200	[thread overview]
Message-ID: <87cznz74l5.fsf@nckx> (raw)
In-Reply-To: <878rynh0yq.fsf@systemreboot.net>

[-- Attachment #1: Type: text/plain, Size: 1855 bytes --]

Hi Arun,

Arun Isaac 写道:
> If security is a problem with a public access guix offload 
> server, we
> could make it semi-public and available at least to people with 
> commit
> access.

Giving access only to people with commit access is a given, but 
any shared offload server is a huge shared security risk.

Guix is not content-addressed.  Any [compromised] user can upload 
arbitrary malicious binaries with store hashes identical to the 
legitimate build.  These malicious binaries can then be downloaded 
by other clients, which presumably all have commit access.

Now the attacker almost certainly has covert access to one or more 
user accounts that can push signed commits to Guix upstream.

> Currently, guix offload requires mutual trust between the master
> and the build machines. If we could make the trust only one-way,
> security might be less of an issue.

It might!  It's easy to imagine a second, less powerful offload 
protocol where clients can submit only derivations to be built by 
the remote daemon, plus fixed-output derivations.  None of the 
‘let me send the entire binary toolchain so you don't have to 
build it from scratch’ of the current protocol.  This at least 
removes their control over the source hash.

At that point, one might consider dropping SSH account-based 
access in favour of a minimal job submission API, and just return 
the results through guix publish or so…?  OTOH, that's yet another 
code path.

> WDYT? How does everyone else handle big builds? Do you have 
> access to
> powerful workstations?

By waiting, and planning.  I'm lucky to have a ridiculously 
overpowered ThinkPad for its age and a newer headless tower at 
home that can run builds 24/7, but nothing close to a ‘powerful 
workstation’ by industry standards.

Zzz,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 247 bytes --]

  reply	other threads:[~2021-10-20 21:45 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-20 20:53 Public guix offload server Arun Isaac
2021-10-20 21:06 ` Tobias Geerinckx-Rice [this message]
2021-10-20 22:54   ` Leo Famulari
2021-10-21 16:46     ` Tobias Geerinckx-Rice
2021-10-21  8:12   ` zimoun
2021-10-21 16:31     ` Tobias Geerinckx-Rice
2021-10-21 18:04       ` zimoun
2021-10-21 21:15       ` Jonathan McHugh
2021-10-21 21:51         ` zimoun
2021-10-21 22:16           ` Tobias Geerinckx-Rice
2021-10-22  7:33             ` zimoun
2021-10-23  5:49               ` Arun Isaac
2021-10-23  7:23                 ` zimoun
2021-10-24  6:43                   ` Arun Isaac
2021-10-25  9:27                     ` indieterminacy
2021-10-22  7:23           ` Jonathan McHugh
2021-10-21 20:23   ` Arun Isaac
2021-10-29 12:04     ` Ludovic Courtès
2021-10-29 12:01   ` Ludovic Courtès
2021-10-20 22:56 ` Leo Famulari
2021-10-21 15:49   ` Joshua Branson
2021-10-21 16:41     ` Tobias Geerinckx-Rice
2021-10-21 17:22     ` Vagrant Cascadian
2021-10-29 12:06       ` Ludovic Courtès
2021-10-29 12:44         ` Tobias Geerinckx-Rice
2021-10-21 23:40     ` jbranso

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87cznz74l5.fsf@nckx \
    --to=me@tobias.gr \
    --cc=arunisaac@systemreboot.net \
    --cc=guix-devel@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).