From mboxrd@z Thu Jan  1 00:00:00 1970
From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=)
Subject: Re: [Nix-dev] Authenticating binary substitutes
Date: Wed, 22 May 2013 18:05:18 +0200
Message-ID: <87ppwjatkx.fsf@gnu.org>
References: <8761ybcaln.fsf@gnu.org>
	<20130522154212.GA6512@vicerveza.homeunix.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Return-path: <bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org>
Received: from eggs.gnu.org ([208.118.235.92]:44978)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <ludo@gnu.org>) id 1UfBXh-0000jA-Gt
	for bug-guix@gnu.org; Wed, 22 May 2013 12:05:39 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <ludo@gnu.org>) id 1UfBXc-0003fX-Tv
	for bug-guix@gnu.org; Wed, 22 May 2013 12:05:33 -0400
Received: from [2a01:e0b:1:123:ca0a:a9ff:fe03:271e] (port=50044
	helo=xanadu.aquilenet.fr) by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <ludo@gnu.org>) id 1UfBXc-0003af-Nx
	for bug-guix@gnu.org; Wed, 22 May 2013 12:05:28 -0400
In-Reply-To: <20130522154212.GA6512@vicerveza.homeunix.net> (=?utf-8?Q?=22?=
	=?utf-8?Q?Llu=C3=ADs?= Batlle i
	Rossell"'s message of "Wed, 22 May 2013 17:42:12 +0200")
List-Id: Bug reports for GNU Guix <bug-guix.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/bug-guix>,
	<mailto:bug-guix-request@gnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/archive/html/bug-guix>
List-Post: <mailto:bug-guix@gnu.org>
List-Help: <mailto:bug-guix-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/bug-guix>,
	<mailto:bug-guix-request@gnu.org?subject=subscribe>
Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org
Sender: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org
To: nix-dev <nix-dev@cs.uu.nl>
Cc: bug-guix@gnu.org

Llu=C3=ADs Batlle i Rossell <viric@viric.name> skribis:

> On Wed, May 22, 2013 at 05:12:20PM +0200, Ludovic Court=C3=A8s wrote:
>> Hello,
>>=20
>> Currently the =E2=80=9Cbinary cache=E2=80=9D substituter relies on DNS t=
o authenticate
>> downloaded binaries: anything coming from, say, hydra.nixos.org is
>> considered authentic, because hydra.nixos.org is listed in the
>> =E2=80=98trusted-binary-cache=E2=80=99 list.
>>=20
>> This is obviously subject to person-in-the-middle attacks: one could
>> connect over Wifi to somebody else=E2=80=99s network, which happens to r=
edirect
>> hydra.nixos.org to evil.example.com, and end up downloading evil binarie=
s.
>>=20
>> I was thinking of a simple extension to solve that:
>>=20
>>   1a. The /nix-cache-info file would contain an (optional)
>>      =E2=80=98OpenPGPFingerprint=E2=80=99 field, to announce the fingerp=
rint of the
>>      OpenPGP key used to sign Nars.
>>=20
>>   1b. In addition to, or alternatively, a /nix-signing-key file would be
>>       served, containing the OpenPGP key used to sign Nars.
>>=20
>>   2.  In addition to serving, say,
>>       /nar/zwpx7d0sv36fi4xpwqx2dak0axx5nji8-gmp-5.1.1, the server would
>>       also serve /nar/zwpx7d0sv36fi4xpwqx2dak0axx5nji8-gmp-5.1.1.sig, an
>>       OpenPGP binary signature of the uncompressed Nar.
>>=20
>> WDYT?  Could this be implemented in Hydra?
>
> I add myself to the request.

Thanks.  ;-)

> The /nix-cache-info or /nix-signing-key files should be requested
> only once and stored in the local system, unless the user deletes them. I=
f they
> are fetched at every run, we are doomed again.

Sure.  They=E2=80=99re only needed when you get introduced to a server anyw=
ay.

Ludo=E2=80=99.