From: andrewg at d2.net.au (Andrew Griffiths)
Subject: RPM verification

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Axel Grossklaus wrote:
| Andrew Griffiths wrote:
|
| moin,
|
| just a few remarks...
|

cool. feedback, comments, etc is good.

| | Product: rpm
| | Version tested: 4.0.4
|
| | - SuSE recommends to verify with rpm -v --checksig file.rpm. They were
| not
| | contacted.
|
| on the suse distribution the keys for rpm validation are already kept in
| a separate file /usr/lib/rpm/gnupg/pubring.gpg.

Never used SuSE myself. I just went looking for vendors to email. :-)

| and gpg ist called with "--keyring /usr/lib/rpm/gnupg/pubring.gpg"
| (suse patched that into rpm) but
| --keyring only _adds_ keys in the keyring. the keys in the
| default keyring in the users home are used as well.
| seeing /usr/lib/rpm/gnupg/pubring.gpg might fool someone into believing
| that _only_ those keys are used, which would require setting
| --no-default-keyring as well.
|
| i dont know if /usr/lib/rpm/gnupg/pubring.gpg was added just to make
| sure the key is available regardless of what the user has in his
| gnupg-home or for security reasons.
|
| if it was for security reasons (which i dont think), its broken :-}
|
| this might be a matter of taste, but keeping keys for rpm-signatures
| in a different file is certainly a good idea, i think.
|
| unfortunately, this is not really easy to do system-wide, since gpg
| wants to lock files and write temp-files into its home-directory,
| so setting %_gpg_path to /usr/lib/rpm/gnupg/ doesnt work.
| each admin on a system has to fix it for himself.
|
| otoh, i dont think that using rpm -v --checksig is a good
| idea either.

Agreed. I'm just repeating what the RPM author told me is the fix. :-)
Personally, I use -vv --checksig.

| its too easy to make a key that looks almost (but
| not quite ;) ) like a given other key. and who really wants to
| memorize the complete fingerprint and key id?

Yup. Thats why I included the stuff for ~/.rpmmacros (hrm. I think rpm
3.x uses .rpmrc or so, I think)

|
| maybe it would work if rpm created an empty temporary directory,
| used that directory with --homedir and then add --keyring
| /usr/lib/rpm/gnupg/pubring.gpg and --no-default-keyring
| (and maybe some option to deal with the trustdb handling) might work.
| but there has to be a more elegant solution than this.

Yup. I setup my .rpmmacros to look @ ~/.gpg-rh (or ~/.gpg-rpm or so).

|
| i will look a little deeper into the last two points..
|
| | - Future versions of RPM (4.1) will not be using gpg externally, but
| | will be maintaining the keys to verify internally.
|
| how exactly will that version work?

By storing the keys to verify stuff in its own database. I think, but am
~     not sure, that it would "embed" gpg or so into rpm.

I haven't looked @ rpm 4.1 yet..


|
|
| tty, axel
|
|
| p.s.: all tests were done using 3.0.6 (suse still uses rpm 3.x)
| ~      and gpg 1.0.7
|
| --
| Axel Grossklaus                            PRESECURE (R)
| Security Specialist,                     Consulting GmbH
| Phone: (+49) 040 / 480 4224             ag@...-secure.de
|
| ~      Check on European Security Incident Response Teams
| ~      http://www.ti.terena.nl


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAj1vUkQACgkQoAeEnVqYoAFm4gCdEKZPFsKoNE3hWxirP5zFPwGs
UvEAnAkPFyQYljiEa6A3U4wlw8uAFaOf
=tvBt
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists