-
Notifications
You must be signed in to change notification settings - Fork 1.1k
/
opam
120 lines (107 loc) · 5.11 KB
/
opam
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
opam-version: "2.0"
homepage: "https://github.com/hannesm/conex"
dev-repo: "git+https://github.com/hannesm/conex.git"
bug-reports: "https://github.com/hannesm/conex/issues"
doc: "https://hannesm.github.io/conex/doc"
maintainer: ["Hannes Mehnert <hannes@mehnert.org>"]
license: "BSD-2-Clause"
build: [
[
"ocaml"
"pkg/pkg.ml"
"build"
"--pinned"
"%{pinned}%"
"--tests"
"false"
"--with-format"
"%{opam-format:installed}%"
]
["ocaml" "pkg/pkg.ml" "build" "--pinned" "%{pinned}%" "--tests" "true"]
{with-test}
["ocaml" "pkg/pkg.ml" "test"] {with-test}
]
depends: [
"ocaml" {>= "4.03.0" & < "5.0.0"}
"ocamlfind" {build}
"ocamlbuild" {build}
"topkg" {build}
"cmdliner"
"opam-file-format" {>= "2.0.0~beta"}
"cstruct" {>= "1.6.0"}
"nocrypto" {>= "0.5.3"}
"x509" {>= "0.4.0" & < "0.7.0"}
"alcotest" {with-test}
"logs"
"fmt"
"rresult"
"astring"
]
depopts: [
"opam-format"
]
synopsis: "Establish trust in community repositories"
description: """
[Conex](https://github.com/hannesm/conex) is a library to verify and attest release integrity and
authenticity of a community repository through the use of cryptographic signatures.
NOTE: This is still work in progress, to be deployed with opam 2.0 and the [opam
repository](https://github.com/ocaml/opam-repository). A [getting started
with conex article](https://hannes.nqsb.io/Posts/Conex) is online.
![screenshot](https://berlin.ccc.de/~hannes/conex.png)
Packages are collected in a community repository to provide an index and
allowing cross-references. Authors submit their packages to the repository. which
is curated by a team of janitors. Information
about a package stored in a repository includes: license, author, releases,
their dependencies, build instructions, url, tarball checksum. When someone
publishes a new package, the janitors integrate it into the repository, if it
compiles and passes some validity checks. For example, its name must not be misleading,
nor may it be too general.
Janitors keep an eye on the repository and fix emergent failures. A new
compiler release, or a release of a package on which other packages depend, might break the compilation of
a package. Janitors usually fix these problems by adding a patch to the build script, or introducing
a version constraint in the repository.
*Conex* ensures that every release of each package has been approved by its author or a quorum of janitors.
A conex-aware client initially verifies the repository using janitor key fingerprints as anchor.
Afterwards, the on-disk repository is trusted, and every update is verified (as a patch) individually.
This incremental verification is accomplished by ensuring all resources
that the patch modifies result in a valid repository with
sufficient approvals. Additionally, monotonicity is preserved by
embedding counters in each resource, and enforcing a counter
increment after modification.
This mechanism avoids rollback attacks, when an
attacker presents you an old version of the repository.
Opam2 has support for a [`repository validation
command`](http://opam.ocaml.org/doc/2.0/Manual.html#configfield-repository-validation-command)
which `conex_verify` is supposed to be in the future.
A timestamping service (NYI) will periodically approve a global view of the
verified repository, together with a timestamp. This is then used by the client
to prevent mix-and-match attacks, where an attacker mixes some old packages and
some new ones. Also, the client is able to detect freeze attacks, since at
least every day there should be a new signature done by the timestamping service.
The trust is rooted in digital signatures by package authors. The server which
hosts the repository does not need to be trusted. Neither does the host serving
release tarballs.
If a single janitor would be powerful enough to approve a key for any author,
compromising one janitor would be sufficient to enroll any new identities,
modify dependencies, build scripts, etc. In conex, a quorum of janitors (let's
say 3) have to approve such changes. This is different from current workflows,
where a single janitor with access to the repository can merge fixes.
Conex adds metadata, in form of resources, to the repository to ensure integrity and
authenticity. There are different kinds of resources:
- *Authors*, consisting of a unique identifier, public key(s), accounts.
- *Teams*, sharing the same namespace as authors, containing a set of members.
- *Authorisation*, one for each package, describing which identities are authorised for the package.
- *Package index*, for each package, listing all releases.
- *Release*, for each release, listing checksums of all data files.
Modifications to identities and authorisations need to be approved by a quorum
of janitors, package index and release files can be modified either by an authorised
id or by a quorum of janitors."""
authors: "Hannes Mehnert <hannes@mehnert.org>"
url {
src:
"https://github.com/hannesm/conex/releases/download/0.9.2/conex-0.9.2.tbz"
checksum: [
"sha256=4081f7e860dca2856609d4f22f25c2c23db5944a9925f6ed206ac9422c41115f"
"md5=91025ad2e155afad333b2473568c9102"
]
}