Re: Proposal: Trust feeds served via HTTPS without GPG signature

Bastian,
	Generally, this means that any CA, or government controlling one, could potentially sign any package. 
That's a pretty big attack surface. Its already failed at least twice when Comodo and DigiNotar where compromised. 
One mitigation for that problem is certificate pinning. Chrome, Firefox and Opera implemented that but now Chrome is going to pull it out in Chrome 67.
https://www.zdnet.com/article/google-chrome-is-backing-away-from-public-key-pinning-and-heres-why/
Also this means that only systems with up to date certificates can install these packages.

I've found getting the dependencies correct, and manually creating commands and entry points to take much more effort than signing the packages.
On Windows if you have Putty Pageant, you only have to enter your key password once and then signing is as easy as saving the file.

Phil

-----Original Message-----
From: Bastian Eicher [mailto:[email protected]] 
Sent: Tuesday, May 15, 2018 1:43 PM
To: ''The Zero Install system'' <[email protected]>
Subject: [Zero-install-devel] Proposal: Trust feeds served via HTTPS without GPG signature

Hello all,

creating Zero Install feeds is pretty straight-forward for new users, thanks to Thomas' great documentation. Especially the fact that hosting feeds only requires an HTTP server serving static files makes the entry barrier very low. However, the step of signing feeds with GPG signatures adds a slight hurdle. Rather than simply editing XML files with whatever method they chose, publishers must always include tools like 0publish or 0repo in their workflow. While these are fairly easy to get up and running it still lacks the simplicity of "just write a file and upload it".

There seems to be a trend for modern package-manager-like systems to rely on HTTPS for verifying the identity and integrity of a package. Docker images pulled from registries are a great example of this. This meshes well with the wide-spread adoption of Let's Encrypt that make TLS certificates just as accessible as GPG keypairs.

I would therefore like to propose a new "feature" for Zero Install: Trust any feed downloaded from an HTTPS URL even if it does not have a GPG signature.

What do you guys think about this? Would it help with adoption? Would we be opening up potential security problems?

Regards
Bastian


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! https://urldefense.proofpoint.com/v2/url?u=http-3A__sdm.link_slashdot&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=DyZCViLjyeufTHY2AgBZfHyFKQPX2npUhcXGGW4ZNYE&s=9hW07GRARFwissy4fqtdI0ZweYDucEd-S3PALs8xwMU&e=
_______________________________________________
Zero-install-devel mailing list
[email protected]
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.sourceforge.net_lists_listinfo_zero-2Dinstall-2Ddevel&d=DwICAg&c=4ZIZThykDLcoWk-GVjSLmy8-1Cr1I4FWIvbLFebwKgY&r=pRAqyHFQFv0HoEiWgk-8HFVA7XY6phT8Klx-jbb5O0E&m=DyZCViLjyeufTHY2AgBZfHyFKQPX2npUhcXGGW4ZNYE&s=0poaaZ0YOw2rRBrwH8gN0cfqpKmzPK1eq7RTmVGbzEk&e= 

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot