linux-kernel - Re: linux-firmware signed commits; does anyone care?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CADnq5_MC+WYSdPPmMoFYzwwC1ANwtjo0XvEhOLbOLkPfYs4hiw@mail.gmail.com>
Date:   Fri, 16 Sep 2022 17:29:10 -0400
From:   Alex Deucher <alexdeucher@...il.com>
To:     Josh Boyer <jwboyer@...nel.org>
Cc:     Linux Firmware <linux-firmware@...nel.org>,
        Juerg Haefliger <juerg.haefliger@...onical.com>,
        Peter Robinson <pbrobinson@...oraproject.org>,
        Takashi Iwai <tiwai@...e.com>, contact@...rentcarlier.com,
        mpagano@...too.org,
        "Limonciello, Mario" <Mario.Limonciello@....com>,
        Jared Dominguez <jaredz@...hat.com>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        "Linux-Kernel@...r. Kernel. Org" <linux-kernel@...r.kernel.org>
Subject: Re: linux-firmware signed commits; does anyone care?

No objections from me.  I don't see much value in it.

Alex

On Fri, Sep 16, 2022 at 9:33 AM Josh Boyer <jwboyer@...nel.org> wrote:
>
> Some time ago, we went back to doing ~monthly releases for
> linux-firmware primarily to help distributions package firmware in a
> simpler manner.  We GPG sign the tarballs, as is good practice, but as
> part of reintroducing the tarballs we also started having a
> linux-firmware maintainer GPG sign *every* commit done by a
> maintainer.  The intention there was that because we're dealing with
> binary blobs we really have no recourse to see changes unlike a source
> code repo.  The signed commits at least provides a measure for
> interested people to ensure the repo itself is only being committed to
> by a recognized maintainer and it isn't compromised (in theory).  The
> downside is that pull requests are merged non-ff and we wind up
> signing the merge commit.
>
> The question at hand though, is does anyone care about the GPG signed
> commits?  It's not clear to me this practice is even noticed nor if it
> is bringing any value to this project.  Since we've started this
> practice, I am literally the only one committing to the repo and while
> it isn't hard to do I want to know if it's actually useful to anyone.
>
> I ask for two separate reasons.  The first is that a group of
> interested firmware submitters is looking at modernizing the workflow
> for the linux-firmware project and moving to a merge request workflow
> instead of submitting giant binary blob patches via email.  This would
> allow us to put some CI in place for simple checks to the WHENCE file,
> etc.  Doing this while still having GPG signed commits isn't
> impossible but it certainly complicates things a bit, and would likely
> require a trusted bot to sign commits.  That has implications on
> secret storage and changes the dynamic on trust levels that make the
> whole thing even more questionable.
>
> The second reason is that even if people are validating the GPG signed
> commits, it's not exactly user friendly.  I've been looking at
> sigstore and recor and that might be a better solution in the long run
> if we do want to utilize something like the current scheme.
>
> I'll still GPG sign the tarballs, but I'd like to propose dropping our
> current self-imposed requirement that all commits are GPG signed.
> Thoughts?
>
> josh