YUM security issues...
seth vidal
skvidal at fedoraproject.org
Mon Jul 28 21:38:35 UTC 2008
On Mon, 2008-07-28 at 17:37 -0400, Jeremy Katz wrote:
> On Mon, 2008-07-28 at 17:29 -0400, seth vidal wrote:
> > On Mon, 2008-07-28 at 17:28 -0400, Mike McLean wrote:
> > > On Mon, Jul 28, 2008 at 1:07 PM, Matt Domsch <Matt_Domsch at dell.com> wrote:
> > > > 1. repomd.xml needs to be signed. Either attached or detached sig
> > > > (advice sought). If attached, format would be
> > >
> > > I see a number of good ideas to improve the situation, but I don't
> > > think I've seen anyone suggest the following.
> > >
> > > Would it be feasible to audit the mirror content? We have the list of
> > > mirrors, we know what the content should be. I think we'd only need to
> > > validate the mirrored repomd.xml, right? Doesn't seem to onerous...
> > >
> > > yes, yes, not perfect, malicious mirror could change the content, etc,
> > > but at least we'd have some measure of detection.
> >
> > which is the point. A malicious mirror could safely lie to us and not
> > lie to their targets.
> >
> > Additionally, mirrormanager DOES check the mirrors.
>
> Except, of course, for mirrors which are internal to a specific site and
> thus can't be contacted by MM
>
and if they're evil then the folks involved are screwed anyway....
which, after all, is why we're in favor of repomd.xml signing
-sv
More information about the infrastructure
mailing list