Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of chirino@gmail.com designates
 209.85.128.190 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:sender:to:subject:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references:x-google-sender-auth;
        b=kg9OHp2TMP1K+Z4v/oHxCBAVq7IEtr9pbNu/BUah+3jHEuxn8sJqogso4LnnX3M5lz
         uts74IoCYeUWbBdV+QFf6jYZNAUYpmtXU9MMj7H82NrGvaB+PGiJX/83NX+OR/j9BLIK
         v+ji5P4OHZwAWog7jkcx4N0NOL5dNjkYihxf8=
Message-ID: <af2843cd0810060724w2cb98811j267ab7c9f0109c5d@mail.gmail.com>
Date: Mon, 6 Oct 2008 10:24:49 -0400
From: "Hiram Chirino" <hiram@hiramchirino.com>
Sender: chirino@gmail.com
To: general@incubator.apache.org, henning@apache.org
Subject: Re: status of PGP support in Maven
In-Reply-To: <af2843cd0810060708n7d36b65t3560aec6a9b7c2ed@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <NBBBJGEAGJAKLIDBKJOPGEJMHDAD.noel@devtech.com>
	 <1223078492.4003.1.camel@forge.local>
	 <af2843cd0810060708n7d36b65t3560aec6a9b7c2ed@mail.gmail.com>

Note that problem A and B both occur at manual steps in the
build/development process.
Just wanted to point that out to folks who complain that maven is
insecure because it downloads stuff automatically.

With checksums, as long as the manual steps are secure, automated bits
should be secure too.

Regards,
Hiram

> There are maven plugins that can validate the checksums of 3rd party
> dependencies.  Works well as long as:
> A) You can trust that your apache-baz-1.0 source has not been tampered with.
> B) The dependency had not been tampered with at the time that the
> dependency was first added to the build.  (Since that's when the
> expected checksum is calculated)
>
> Problem A: is universal to all builds at apache even if it's a maven
> based or make based build.  I guess this is what the GPG discussion is
> about.
> Problem B: Could be further reduced if the 3rd party used some type
> signing to help the apache developers validate that the 3rd party
> artifact is indeed authentic.
>
> If dependency checksum validation was encouraged by all our source
> builds, I think Problem B would become even less of a problem because
> you would get a network effect between all the source builds.  As more
> more projects add a 3rd party dependency validated by a checksum, it
> becomes harder to exploit that 3rd party dependency as the artifact
> checksum gets checked by more and more builds.  Tampering with the
> artifact would result some builds builds breaking and folks
> investigating the tampering.  Therefore the most effective way to
> tamper with a 3rd party artifact would be to do it when the 3rd party
> artifact first gets deployed.  So in effect we reduce the
> vulnerability window that exploits are effective in, which I think
> helps.
>
> --
> Regards,
> Hiram
>
> Blog: http://hiramchirino.com
>
> Open Source SOA
> http://open.iona.com
>


-- 
Regards,
Hiram

Blog: http://hiramchirino.com

Open Source SOA
http://open.iona.com

---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org