From: Joanna Rutkowska <joanna@invisiblethingslab.com>
To: Keir Fraser <keir.fraser@eu.citrix.com>
Cc: "xen-devel@lists.xensource.com" <xen-devel@lists.xensource.com>
Subject: Re: Xen signing and wget
Date: Tue, 06 Jul 2010 17:23:56 +0200 [thread overview]
Message-ID: <4C334A8C.1080007@invisiblethingslab.com> (raw)
In-Reply-To: <C85908A0.19807%keir.fraser@eu.citrix.com>
[-- Attachment #1.1: Type: text/plain, Size: 858 bytes --]
On 07/06/10 17:21, Keir Fraser wrote:
> On 06/07/2010 16:12, "Joanna Rutkowska" <joanna@invisiblethingslab.com>
> wrote:
>
>> While the Xen sources have recently become digitally signed by xen.org
>> (which is just great), there is still a problem that its various
>> Makefiles download (and subsequently build) various 3rd party software
>> via wget (e.g. ioemmu, grub, tboot, etc). Unless I'm missing something,
>> the downloaded 3rd part software is never verified in any way.
>
> We download tarballs from http://xenbits.xensource.com/xen-extfiles rather
> than random 3rd party sites. And qemu from our very own git repository also
> on xenbits.
>
But you use plaintext connection, which, in security, means random code.
I think we have already went through this last time when discussing the
signing process for Xen ;)
joanna.
[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 226 bytes --]
[-- Attachment #2: Type: text/plain, Size: 138 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
next prev parent reply other threads:[~2010-07-06 15:23 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-07-06 15:12 Xen signing and wget Joanna Rutkowska
2010-07-06 15:21 ` Keir Fraser
2010-07-06 15:23 ` Joanna Rutkowska [this message]
2010-07-06 15:24 ` Keir Fraser
2010-07-06 15:27 ` Joanna Rutkowska
2010-07-06 15:34 ` Keir Fraser
2010-07-06 15:42 ` Joanna Rutkowska
2010-07-06 15:50 ` Xen signing and wget [and 3 more messages] Ian Jackson
2010-07-06 15:56 ` Joanna Rutkowska
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4C334A8C.1080007@invisiblethingslab.com \
--to=joanna@invisiblethingslab.com \
--cc=keir.fraser@eu.citrix.com \
--cc=xen-devel@lists.xensource.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.