Re: detached gpg signature on repomd.xml

On Mon, Aug 28, 2006 at 08:36:46AM -0400, Jeff Johnson wrote:
> 
> On Aug 28, 2006, at 3:18 AM, Florian La Roche wrote:
> 
> >On Sat, Aug 26, 2006 at 12:30:18PM -0400, seth vidal wrote:
> >>Hi folks,
> >> as a result of a rather lengthy and ranging discussion elsewhere it
> >>came out that a gpg signature of repomd.xml would heighten the  
> >>security
> >>of using these type of repositories.
> >
> >Ack, that would be useful. From repomd.xml we get sha1 for the other
> >repository data and primary.xml contains sha1 for all rpm packages.
> >
> 
> That is a workable trust model for yum iff the package sha1 is  
> checked before any
> data from the package is used.

The big nono would be using only the header parts without either checking
the full file or you need to take the header signature and verify that
as well.

> Please remember to verify the package sha1, using data from signed  
> repomd.xml,
> before using any other information from the *.rpm package. That is  
> the only logically
> consistent implementation that I am aware of.

The nice part of using the sha1 checksum is that
- The data is already included in the current repo data.
- You could think about solving downloads from several mirrors and
  inconsistent mirrors by building up a sha1 cache of files and can
  download data from mirrors until you have all needed bits together ;-)
  This might make mirror selection and how to trust data from several
  unsyncronized download mirrors much easier.

regards,

Florian La Roche