Archive detached signature #129

vp1981 · 2020-11-04T08:20:57Z

Hello,
versions prior to 2.19 have detached signatures (.asc) but 2.19 doesn't have one. Is it on purpose? Should I use github git repo as verified source of radvd?

reubenhwk · 2020-11-07T04:04:47Z

I'd suggest using Github. I'm not keen on continuing to maintain the RADVD website and I'd like to replace it with a message to get all future updates from Github.

…

On Wed, Nov 4, 2020 at 12:21 AM Vladimir Lomov ***@***.***> wrote: Hello, versions prior to 2.19 have detached signatures (.asc) but 2.19 doesn't have one. Is it on purpose? Should I use github git repo as verified source of radvd? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#129>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABRG6YJSBEOGYYPMMOQC4LSOEFHRANCNFSM4TJXUVHA> .

vp1981 · 2020-11-07T07:35:22Z

Hello. Yes, I already use source from github (I'm using Archlinux and has updated PKGBUILD to build new radvd fetching source from github). May be it is worth to sign tags then? Right now I don't use such feature but think it would valuable thing to have. And small nitpick: the "Release" part of "main" page on github leads to "Release" page that doesn't list latest release, I see it only on "Tag" page.

anthraxx · 2020-11-17T10:49:59Z

@reubenhwk I understand that you do not want to maintain the website, however would it be possible to gpg sign your git tags or upload detatched signatures to the git releases?

git archive -o radvd-2.19.tar.gz --format tar.gz --prefix=radvd-2.19/ 2.19
gpg --detach-sign radvd-2.19.tar.gz

you can put that in a Makefile/script and use some variables. It would be super awesome if you can keep signing releases, this is a important part of supply chain security authenticating the legitimacy of a release from you, the author.

Neustradamus · 2020-12-06T15:26:06Z

I think it is needed to have a perfect 2.20 soon.

With last PRs

With a perfect announcement at the same time:

Mailing lists
Official website
Releases section (always not done for 2.18 and 2.19) : https://github.com/reubenhwk/radvd/releases
Signature

Neustradamus · 2021-01-08T07:03:46Z

@reubenhwk: There is a big problem for Debian 11, the freeze is soon (2021-01-12).
The next will be in 2023.

Can you solve it with a 2.20 now?
Please read all steps to do at the same time?

Archive detached signature #129 (comment)

The 2.19 is not here: https://tracker.debian.org/pkg/radvd
cc @stappersg

It is linked to:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=973922

Thanks in advance.

Neustradamus · 2021-01-09T10:25:07Z

@vp1981 @anthraxx @stappersg: @reubenhwk has generated signatures:

https://github.com/radvd-project/radvd/releases/tag/v2.19

foxxx0 · 2021-01-09T11:06:18Z

Unfortunately these signatures have been made with a RSA key 0xBE8BA2B61F1B1E57 that I can't seem to find anywhere.

 $ gpg --list-packets < radvd-2.19.tar.gz.asc 
# off=0 ctb=89 tag=2 hlen=3 plen=435
:signature packet: algo 1, keyid BE8BA2B61F1B1E57
	version 4, created 1610178092, md5len 0, sigclass 0x00
	digest algo 10, begin of digest 11 55
	hashed subpkt 33 len 21 (issuer fpr v4 BABABE4BCC326327BFB6C133BE8BA2B61F1B1E57)
	hashed subpkt 2 len 4 (sig created 2021-01-09)
	subpkt 16 len 8 (issuer key ID BE8BA2B61F1B1E57)
	data: [3072 bits]

The previous released have been signed with RSA key 0x6FE19F21451C9A2B / fingerprint 10E2 5110 3817 2B51 6DCA 5BD3 6FE1 9F21 451C 9A2B and uid Reuben Hawkins <reubenhwk@gmail.com>.

So as of right now, these signatures aren't helping at all.

stappersg · 2021-01-09T12:16:18Z

So as of right now, these signatures aren't helping at all.

@anthraxx expressed it already very well earlier:

It would be super awesome if you can keep signing releases, this is a important part of supply chain security authenticating the legitimacy of a release from you, the author.

I think #135 is both problem and solution.

Neustradamus · 2021-01-09T18:20:19Z

@reubenhwk has generated signatures and it is the last 2.19 from him.

@reubenhwk, can you look the problem of signatures before?

The radvd repositories have been moved from:

Thanks in advance.

Neustradamus · 2021-01-09T18:24:18Z

Currently, there is always the original website, files and signatures are on it too:

http://www.litech.org/radvd/

Neustradamus · 2021-01-21T01:36:55Z

@vp1981 @anthraxx @foxxx0, @stappersg: @robbat2 has done new signatures:

https://github.com/radvd-project/radvd/releases/tag/v2.19

foxxx0 · 2021-01-22T16:34:37Z

Thanks, but in order to keep the trust chain intact, we still need a gpg-signed statement from @reubenhwk (with 0x6FE19F21451C9A2B / fp 10E2 5110 3817 2B51 6DCA 5BD3 6FE1 9F21 451C 9A2B) that @robbat2 is now in charge of this project and explicitly stating that their key 0xEE05E6F6A48F6136 with fingerprint 7D0B 3CEB E9B8 5B1F 825B CECF EE05 E6F6 A48F 6136 is now the official and approved new release signing key.

Otherwise having the releases signed with a different "untrusted" (no offense) gpg key doesn't really mean anything.

Neustradamus · 2021-01-22T17:44:06Z

@foxxx0: @robbat2 has already worked previously:

https://github.com/radvd-project/radvd/pulls?q=is%3Apr+author%3Arobbat2+

robbat2 · 2021-01-22T18:49:23Z

@foxxx0 Reuben's old key is no longer available. Reuben does have a new key, but there's no meaningful handover message possible since Reuben lost their old key.

From my newer key 0xEE05E6F6A48F6136, you can see transitive signatures to my older key 0xEE05E6F6A48F6136, and then onto the main kernel WoT.

I'll also point out that there was also no chain of trust between Reuben's older key 0x411FA8C112D91A31:

radvd-2.16.tar.gz.asc 2017-02-01 411FA8C112D91A31
radvd-2.17-rc1.tar.gz.asc 2017-07-02 411FA8C112D91A31
radvd-2.17.tar.gz.asc 2017-07-04 411FA8C112D91A31
radvd-2.18-rc1.tar.gz.asc 2019-02-17 6FE19F21451C9A2B
radvd-2.19.tar.gz.asc 2021-01-21 19395F23C58826C4

stappersg · 2021-01-22T22:41:08Z

On Fri, Jan 22, 2021 at 10:49:40AM -0800, Robin H. Johnson wrote: ... chain of trust ...

Each chain has to start with a first link

robbat2 · 2021-01-24T23:01:15Z

A question for both @foxxx0 @stappersg:
As @reubenhwk has lost their prior keys, what further assurances do you believe are possible and meaningful to show that @reubenhwk has handed control of the project to myself and @Neustradamus?

Once we've got most of this sorted out, including getting more willing developers into the GitHub organization, so they can provide meaningful reviews of code, I would like to move the radvd project to having dedicated formal release keys, so that we can avoid future problems in handover (having enough open source experience to know that nobody will be around forever, regardless of their best intentions).

Neustradamus · 2021-01-31T07:26:12Z

Solved by @robbat2.

Neustradamus · 2021-02-04T17:59:34Z

One hour ago, @reubenhwk has done a comment here: #135 (comment).

@stappersg: Can you now update radvd in Debian?

https://tracker.debian.org/pkg/radvd

@foxxx0: Can you now update radvd in Arch Linux?

https://archlinux.org/packages/community/x86_64/radvd/

Thanks in advance.

stappersg · 2021-02-04T21:41:45Z

radvd-project/radvd-project.github.io@6e3e5f7 where to get the pubkey of which it was done with?

Neustradamus · 2021-02-05T14:35:14Z

@stappersg: It is here:

I have added links in index.html:

radvd-project/radvd-project.github.io@91d3ebf

The upstream project has been handed over from reubenhwk to robbat2. Unfortunately reubenhwk has lost his gpg key previously used for release signing and thus the "official" handover process is only documented here: radvd-project/radvd#129 radvd-project/radvd#138 From now on the releases will be signed by robbat2 with 7D0B3CEBE9B85B1F825BCECFEE05E6F6A48F6136. While this handover process has been rather unfortunate, especially with respect to reubenhwk losing his gpg key, we have investigated the code changes and some of robbat2/s previous contributions to the radvd project and seem as confident as can be that there was no malicous intent and are now considering 7D0B3CEBE9B85B1F825BCECFEE05E6F6A48F6136 as trustworthy for release signatures. git-svn-id: file:///srv/repos/svn-community/svn@884281 9fca08f4-af9d-4005-b8df-a31f2cc04f65

stappersg mentioned this issue Dec 6, 2020

New version: 2.19? #125

Closed

Neustradamus mentioned this issue Jan 24, 2021

Undefined state #138

Closed

Neustradamus closed this as completed Jan 31, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Archive detached signature #129

Archive detached signature #129

vp1981 commented Nov 4, 2020 •

edited

reubenhwk commented Nov 7, 2020 via email

vp1981 commented Nov 7, 2020

anthraxx commented Nov 17, 2020

Neustradamus commented Dec 6, 2020 •

edited

Neustradamus commented Jan 8, 2021

Neustradamus commented Jan 9, 2021

foxxx0 commented Jan 9, 2021 •

edited

stappersg commented Jan 9, 2021

Neustradamus commented Jan 9, 2021 •

edited

Neustradamus commented Jan 9, 2021

Neustradamus commented Jan 21, 2021 •

edited

foxxx0 commented Jan 22, 2021 •

edited

Neustradamus commented Jan 22, 2021

robbat2 commented Jan 22, 2021

stappersg commented Jan 22, 2021 via email

robbat2 commented Jan 24, 2021 •

edited

Neustradamus commented Jan 31, 2021

Neustradamus commented Feb 4, 2021

stappersg commented Feb 4, 2021

Neustradamus commented Feb 5, 2021

Archive detached signature #129

Archive detached signature #129

Comments

vp1981 commented Nov 4, 2020 • edited

reubenhwk commented Nov 7, 2020 via email

vp1981 commented Nov 7, 2020

anthraxx commented Nov 17, 2020

Neustradamus commented Dec 6, 2020 • edited

Neustradamus commented Jan 8, 2021

Neustradamus commented Jan 9, 2021

foxxx0 commented Jan 9, 2021 • edited

stappersg commented Jan 9, 2021

Neustradamus commented Jan 9, 2021 • edited

Neustradamus commented Jan 9, 2021

Neustradamus commented Jan 21, 2021 • edited

foxxx0 commented Jan 22, 2021 • edited

Neustradamus commented Jan 22, 2021

robbat2 commented Jan 22, 2021

stappersg commented Jan 22, 2021 via email

robbat2 commented Jan 24, 2021 • edited

Neustradamus commented Jan 31, 2021

Neustradamus commented Feb 4, 2021

stappersg commented Feb 4, 2021

Neustradamus commented Feb 5, 2021

vp1981 commented Nov 4, 2020 •

edited

Neustradamus commented Dec 6, 2020 •

edited

foxxx0 commented Jan 9, 2021 •

edited

Neustradamus commented Jan 9, 2021 •

edited

Neustradamus commented Jan 21, 2021 •

edited

foxxx0 commented Jan 22, 2021 •

edited

robbat2 commented Jan 24, 2021 •

edited