Enable GPG signatures for the RPM repo

[dskrvk]

The RPM repo file has gpgcheck=0 since the releases there are currently not signed. This is a pretty serious security issue for anyone using SBT as part of their release process on an RHEL/CentOS machine. The corresponding Debian releases already include signatures. What would it take to enable them for RPM as well?

This is a follow-up to #2049. See also the post on secure RPM distribution originally linked in that issue.

[eed3si9n]

The repo file is generated by Bintray.

$ curl https://bintray.com/sbt/rpm/rpm
#bintray--sbt-rpm - packages by  from Bintray
[bintray--sbt-rpm]
name=bintray--sbt-rpm
baseurl=https://sbt.bintray.com/rpm
gpgcheck=0
repo_gpgcheck=0
enabled=1

*.asc files are there - https://sbt.bintray.com/rpm/sbt-1.3.8.rpm.asc, so I am not sure what I can do.

[eed3si9n]

ok, so the article says there's a tool to add signature into the rpm file:

The rpmsign command to create the signature looks like this:

$ rpmsign -D '_gpg_name rpmsign@example.com' --addsign hello-2.10.1-1.el6.x86_64.rpm
Enter pass phrase:
Pass phrase is good.
hello-2.10.1-1.el6.x86_64.rpm:

This looks useful if we can automate it.

We'd still have the generated repo file problem.

[dskrvk]

What process generates this file?

[eed3si9n]

The repo file is provided by Bintray.

[tomasherman]

👍 this is an issue for us aswell

[dskrvk]

So there’s no way to contact them or affect the way the repo file is structured?

…

On Tue, Feb 25, 2020 at 9:01 AM Tomas Herman ***@***.***> wrote: 👍 this is an issue for us aswell — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#5426?email_source=notifications&email_token=AARJT2AJ3THBMLUOGK4RPBTREUQCPA5CNFSM4KR5YXQ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEM4CBEQ#issuecomment-590880914>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AARJT2C7CIZ62GUD7MEM7TDREUQCPANCNFSM4KR5YXQQ> .

[eed3si9n]

I just pinged Bintray. Let's see what they would say.

[SethTisue]

with Bintray dead, is this still applicable?

[esamson]

Yes, I think it is still preferable to have GPG signed RPM. On Fedora, the sbt repo does not play well with the default tooling (Discovery on KDE) to get updates because it expects GPG signatures. That, plus the security issues pointed out earlier.

Checking the current repo:

$ curl -OL https://repo.scala-sbt.org/scalasbt/rpm/sbt-1.8.2.rpm
$ rpm -K sbt-1.8.2.rpm
sbt-1.8.2.rpm: digests OK

Package still has no signatures.