nightlies should be fetched over SSH - or are they already?

[glyph]

http://emacsformacosx.com/about says that nightlies are built from http://git.savannah.gnu.org/cgit/emacs.git/ - the implication of the word "public" being that it is cloned over an unauthenticated transport, and so could be corrupted in transit to you by an attacker. Or do you have an SSH key registered with Savannah? Ideally, you should be cloning the repository from an SSH account (a dedicated account, not your account, with no other SSH access to anything, of course) so that you can at least verify the SSH key.

This is especially important as these binaries are codesigned; if they are built automatically and the code is retrieved via a plaintext transport, it doesn't seem there's any way to verify the code is authentic.

[caldwell]

They are fetched over http, so unauthenticated in that sense. I will see if I can get read-only ssh access to Savannah—I don't know if it's an option. It would be nice if they just offered https.

As a slight consolation, the git hash is prominently displayed, so it can be matched out of band to the real commit that was the basis for the build. Unfortunately, that git hash is served over http so it could theoretically be corrupted in transit, too (plus I only keep track of the abbreviated one :-( ). But, for a full code switcheroo attack to succeed the attacker would have to MITM both my build machine and anyone who tries to verify the git hash. This seems highly unlikely in practice.

To sum up, steps needed to be as safe as I can think of:

1. Get nightly code over an authenticated channel.
2. Store the git hash in a file inside the .app bundle where it will get code signed.
3. Keep the full git hash through build process instead of abbreviating it.
4. Serve the final .dmg over https.

4 is unlikely to happen in the short term—the site is served by a cheap shared hosting plan and I don't think they offer ssl without a significant price upgrade. Luckily, it is mitigated by the code signing.

2 and 3 are directly in my control, so I can (and will) do those.

1 may or may not happen, I will try but I can't guarantee success. Luckily, it is mitigated by 2 and 3.

[glyph]

They are fetched over http, so unauthenticated in that sense. I will see if I can get read-only ssh access to Savannah—I don't know if it's an option.

Allegedly it is. I have a Savannah account and I added my SSH public keys though, and the documented SSH endpoint just doesn't work. My ticket is here, so you can get updates there.

It would be nice if they just offered https.

... Yes. Yes it would.. It's really annoying that they have HTTPS for the website but not for the VCS.

As a slight consolation, the git hash is prominently displayed, so it can be matched out of band to the real commit that was the basis for the build. Unfortunately, that git hash is served over http so it could theoretically be corrupted in transit, too (plus I only keep track of the abbreviated one :-( ). But, for a full code switcheroo attack to succeed the attacker would have to MITM both my build machine and anyone who tries to verify the git hash. This seems highly unlikely in practice.

SHA-1 is basically broken at this point (see: CAs deprecating it aggressively) so I think this is of limited utility. This is why Git has signed commits as a separate feature. Still, it would be a nice indicator of provenance and at least a medium-strength demonstration of the "chain of evidence" from the VCS to you, as it were.

4 is unlikely to happen in the short term—the site is served by a cheap shared hosting plan and I don't think they offer ssl without a significant price upgrade. Luckily, it is mitigated by the code signing.

Let's Encrypt is in public beta which effectively makes real certs free and automatic. I'm happy to do the work of setting this up for you, if you'd like; I even have some infrastructure I could host it on if you just want to point the DNS towards me.

[caldwell]

The patch I just pushed addresses #2 on the list. #3 has been applied to the Jenkins build script (not under SCM). I emailed the Emacs maintainer about #1 and am waiting on a reply. I'll close this out when I hear back definitively from him.

[glyph]

If the Emacs maintainers are unhelpful in that regard, #1 might be at least partially accomplished by fetching from https://github.com/emacs-mirror/emacs instead; at least that way you're retrieving the code over an authenticated channel.

[caldwell]

A quick update: emacsformacosx.com is now https. That takes care of #4.

[glyph]

Thanks!

[caldwell]

Nightlies are now coming from https://git.savannah.gnu.org/git/emacs.git