[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Authenticating binary substitutes
From: |
Ludovic Courtès |
Subject: |
Authenticating binary substitutes |
Date: |
Wed, 22 May 2013 17:12:20 +0200 |
User-agent: |
Gnus/5.130007 (Ma Gnus v0.7) Emacs/24.3 (gnu/linux) |
Hello,
Currently the “binary cache” substituter relies on DNS to authenticate
downloaded binaries: anything coming from, say, hydra.nixos.org is
considered authentic, because hydra.nixos.org is listed in the
‘trusted-binary-cache’ list.
This is obviously subject to person-in-the-middle attacks: one could
connect over Wifi to somebody else’s network, which happens to redirect
hydra.nixos.org to evil.example.com, and end up downloading evil binaries.
I was thinking of a simple extension to solve that:
1a. The /nix-cache-info file would contain an (optional)
‘OpenPGPFingerprint’ field, to announce the fingerprint of the
OpenPGP key used to sign Nars.
1b. In addition to, or alternatively, a /nix-signing-key file would be
served, containing the OpenPGP key used to sign Nars.
2. In addition to serving, say,
/nar/zwpx7d0sv36fi4xpwqx2dak0axx5nji8-gmp-5.1.1, the server would
also serve /nar/zwpx7d0sv36fi4xpwqx2dak0axx5nji8-gmp-5.1.1.sig, an
OpenPGP binary signature of the uncompressed Nar.
WDYT? Could this be implemented in Hydra?
Ludo’.
pgpxmrndzqFYQ.pgp
Description: PGP signature