Mailing-List: contact infrastructure-dev-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: infrastructure-dev@apache.org
Received-SPF: neutral (nike.apache.org: local policy)
Date: Fri, 12 Apr 2013 10:52:15 -0500
From: "William A. Rowe Jr." <wrowe@rowe-clan.net>
To: infrastructure-dev@apache.org
Cc: cmodien@gmail.com
Subject: Re: Official code signing certificate
Message-ID: <20130412105215.27fc9910@hub>
In-Reply-To: <1502D874-5DFD-4903-B02F-CFABD564C8B7@gmail.com>
References: 
 <CAP-ksohNgeQ+LTiB2VY0b06n_kCrbCC3LhOrtBcaxkmuiNxk5w@mail.gmail.com>
	<51498137.5090505@gmail.com>
	<20130320203757.GG3812@lp-shahaf.local>
	<514ABC79.6080601@gmail.com>
	<20130321120932.GA3496@lp-shahaf.local>
	<514AFDE8.2000000@gmail.com>
	<20130321130639.GA3607@lp-shahaf.local>
	<CAP-ksoin7mvcSHMfHyDuMq+73Dfp2k2qTHwkoRG_sVBcTYa9_A@mail.gmail.com>
	<20130321221814.GB16395@tarsus.local2>
	<CAP-ksogp8rABcXv2wg3cUqbTUu4imK-3w4kP-qzy20Dv_GBr0Q@mail.gmail.com>
	<20130322165713.GJ3216@lp-shahaf.local>
	<CAP-ksojSQd4p+UyrJNL98giX1hpJ=MYCdtHG5DiLB4DDGUSvYw@mail.gmail.com>
	<E1DEEC7A-B436-46F2-B044-690B83041BC8@gmail.com>
	<1502D874-5DFD-4903-B02F-CFABD564C8B7@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Mon, 25 Mar 2013 16:48:41 -0700
Clint Modien <cmodien@gmail.com> wrote:

> I'm not sure if it's economical or not=E2=80=A6 but if the approach is to
> provide private keys and certs to each project it might be wise for
> them to also be unique for each project.

They won't be signed.  Authentcode key signing is structured
one-per-org.

> That way if a cert/key pair is compromised in one project it doesn't
> impact other projects.

Couldn't agree more, a moronic design if you asked me.

The Symantec code signing service, however, ties a distinct key
to each signed object in an auditable method.

As Rob is fond of pointing out, there are literally hundreds of
moving parts in their release (and similarly in the httpd release
as well - each loadable module must be signed).  I've asked and
been assured that the Symantec service would have a batch/group
automation-friendly submission process that could make this
relatively painless.

When I scoped the first ASF-hosted service, I envisioned then
editing each .rc resource entity in the binaries to associate
them to the pgp key which had submitted them for signing, before
then authenticode-signing the objects.  But this still suffers=20
from exactly the threat you identified above.