Making PGP distribution key well-known

[Petr Pisar]

As new Fedora release looms ahead, I'd like open discussion about
verifying distribution integrity. In short---where to get public key for
verifying RPM signatures.

If I remember correctly, you are asked to accept new signing key by rpm
while installing fedora-release package from new Fedora release. Problem
is, there is no way how how to verify the key beeing accepted.

I have been told by RPM developers, RPM allows multiple signatures.
Whould it be possible to sign fedora-relase package from F17 with key
used in F16 in addition?

This procedure would create chain of trust from older to newer Fedora
release making upgrade more secured.

Of course other good approach is to sign F17 public key by well-known
Fedora developers and publish the key with its singatures, e.g. on PGP
key servers.

-- Petr

[Michal Schmidt]

Dne 1.3.2012 17:52, Petr Pisar napsal(a):
>  where to get public key for verifying RPM signatures. 
The keys are at: https://fedoraproject.org/keys

Michal

[Petr Pisar]

On 2012-03-01, Michal Schmidt <mschmidt(a)redhat.com&gt; wrote:
>  Dne 1.3.2012 17:52, Petr Pisar napsal(a):
> > where to get public key for verifying RPM signatures.
>
>  The keys are at: https://fedoraproject.org/keys
>  
And F16 primary key (A82BA4B7) is signed by... 1 guy. Awesome.

And ISO images propagated on Fedora web pages have signatures where?
I see, one must trim the URL manually and hope the web server lists
directory and there will be a signature.

-- Petr

[Kevin Fenzi]

On Fri, 2 Mar 2012 12:53:35 +0000 (UTC)
Petr Pisar <ppisar(a)redhat.com&gt; wrote:

>  On 2012-03-01, Michal Schmidt <mschmidt(a)redhat.com&gt; wrote:
>  > Dne 1.3.2012 17:52, Petr Pisar napsal(a):
>  >> where to get public key for verifying RPM signatures.
>  >
>  > The keys are at: https://fedoraproject.org/keys
>  >
>  And F16 primary key (A82BA4B7) is signed by... 1 guy. Awesome.
>  
>  And ISO images propagated on Fedora web pages have signatures where?
>  I see, one must trim the URL manually and hope the web server lists
>  directory and there will be a signature. 
https://fedoraproject.org/en/verify has a full list of them, but yes,
they should be in the same directory. 

If you can think of a better way to present this data, do say. 

kevin

[Petr Pisar]

On 2012-03-02, Kevin Fenzi <kevin(a)scrye.com&gt; wrote:
>  On Fri, 2 Mar 2012 12:53:35 +0000 (UTC)
>  Petr Pisar <ppisar(a)redhat.com&gt; wrote:
>
> > On 2012-03-01, Michal Schmidt <mschmidt(a)redhat.com&gt; wrote:
> > > Dne 1.3.2012 17:52, Petr Pisar napsal(a):
> > >> where to get public key for verifying RPM signatures.
> > >
> > > The keys are at: https://fedoraproject.org/keys
> > >
> > And F16 primary key (A82BA4B7) is signed by... 1 guy. Awesome.
> >
> > And ISO images propagated on Fedora web pages have signatures where?
> > I see, one must trim the URL manually and hope the web server lists
> > directory and there will be a signature.
>
>  https://fedoraproject.org/en/verify has a full list of them, but yes,
>  they should be in the same directory.
>
>  If you can think of a better way to present this data, do say.
>  
Put them right next to shiny Download links. If the datails about size
are important enough, a link to signature could be there too. Like:

Download Now!
605MB, ISO format image for Intel-compatible PCs (32-bit), signature

Where the `signature' label would point to
<http://download.englab.brq.redhat.com/pub/fedora/linux/releases/16/Live/i...;.

The `Verify Download' link is six sections underneath. Even bellow
export regulations which nobody reads. To far.

-- Petr

[Frank Murphy]

On 05/03/12 10:37, Petr Pisar wrote:
>  Even bellow
>  export regulations which nobody reads. 
I do.

-- 
Regards,
Frank
"Jack of all, fubars"

[Kevin Fenzi]

On Mon, 5 Mar 2012 10:37:47 +0000 (UTC)
Petr Pisar <ppisar(a)redhat.com&gt; wrote:

>  Put them right next to shiny Download links. If the datails about
> size
>  are important enough, a link to signature could be there too. Like:
>  
>  Download Now!
>  605MB, ISO format image for Intel-compatible PCs (32-bit), signature
>  
>  Where the `signature' label would point to
>
> <http://download.englab.brq.redhat.com/pub/fedora/linux/releases/16/Live/i...;.
>  
>  The `Verify Download' link is six sections underneath. Even bellow
>  export regulations which nobody reads. To far. 
Would you be willing to file a websites ticket on this? 

I could as well, but if you file it, you'll have more input in how it's
implemented. ;) 

https://fedorahosted.org/fedora-websites/newticket

kevin

[Petr Pisar]

On 2012-03-05, Kevin Fenzi <kevin(a)scrye.com&gt; wrote:
>  Would you be willing to file a websites ticket on this?=20 
Done: <https://fedorahosted.org/fedora-websites/ticket/88>

-- Petr

[Panu Matilainen]

On 03/01/2012 06:52 PM, Petr Pisar wrote:
>  As new Fedora release looms ahead, I'd like open discussion
> about
>  verifying distribution integrity. In short---where to get public key for
>  verifying RPM signatures.
>
>  If I remember correctly, you are asked to accept new signing key by rpm
>  while installing fedora-release package from new Fedora release. Problem
>  is, there is no way how how to verify the key beeing accepted.
>
>  I have been told by RPM developers, RPM allows multiple signatures.
>  Whould it be possible to sign fedora-relase package from F17 with key
>  used in F16 in addition? 
No, rpm does not support multiple signatures in this sense. There are 
all sorts of different "signature" types in rpm and several of are 
typically present in any (signed) package, but that's a different thing 
(rpm's notion of a "signature" is a bit exotic). There's no fundamental

limitation why it could not ever support this kind of scenario, but 
currently it does not.

	- Panu -