Repository navigation
fix(iso): accept only Colony-signed packages into the offline repository - #8
Merged
Merged
Conversation
offline-repo.sh verified each package with gpg --verify, which accepts a signature from any key in the builder's keyring. It now checks that the signer is the key COLONY_SIGNING_KEY names, so a package signed by another local key stops the image build instead of an install that has already partitioned the disk. test-repo.sh now also proves that the installer's offline pacman.conf refuses a package whose own signature is missing, with a control that installs the same files once package signatures are optional.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #6, from its review.
iso/offline-repo.sh: the pre-copy check usedgpg --verify, which accepts a signature from any key in the builder's default keyring. It now resolves the fingerprint ofCOLONY_SIGNING_KEYand requires theVALIDSIGstatus line to name it (its last field is the primary key, so a subkey signature still matches). A package signed by another local key now stops the image build, not an install that has already partitioned the disk. The installer'sSigLevel = Requiredagainst colony-keyring still refuses it too.tools/test-repo.sh: the offline-repository case only proved that an unsigned database is refused. It now also serves the stand-in package without its.sigunder a database the Colony key signs, and expects the installer's offlinepacman.confto refuse it. A control installs the same files through the same configuration withPackageOptional, so the refusal can only come from the package signature. The cached copy and signature from earlier cases are removed first so they cannot stand in for what is served.The signer check was exercised locally with two throwaway keys: a package signed by the named key passes, one signed by another key in the same keyring, a tampered one and a missing one are refused. CI runs the new test-repo.sh case.