Upgrading installer verification

[Sage Gerard]

Are there any plans to publish GPG signatures for Racket installers, or
at least upgrade the cryptographic hash function used for the checksums?

If not, who would be a good person to talk to about contributing that?

--
~slg

[Sam Tobin-Hochstadt]

I don't think we have plans to start signing installers. The code that
creates installers is in the `distro-build` package, and the use of
sha1 is here: https://github.com/racket/distro-build/blob/21ccc39fc14408eea79aff035e508856a66adf89/distro-build-server/pack-built.rkt#L76

Sam

> --
> You received this message because you are subscribed to the Google Groups "Racket Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to racket-users...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/70e8acf9-9993-0e7c-3d10-b7964cc6ed03%40sagegerard.com.

[Sage Gerard]

Thank you.

--
~slg

[James Platt]

Are you bring this up because of the recent rise of dependency confusion attacks? In any case, it would be good to know where Racket stands with that.

[Alex Harsányi]

Hi James,

If you are worried about dependency confusion attacks, you can set up your own package catalog on an internal server, delete the default catalogs from racket and add only a reference just your internal catalog.  This way, "raco pkg install" will install all packages (and all their dependencies) only from a source which you have full control of.

I use a similar technique when I build my application on the CI server, to ensure that all packages and their dependencies are under source control and no untracked dependency sneaks in via a new package dependency.

Alex.

[Sage Gerard]

No, I'm just looking for extra confidence when verifying installers.

On that note, did Ubuntu require someone to sign packages to distribute
packages via apt? Can that be repurposed here?

> To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/8DEE7478-3E76-43EC-8691-AA44D016E764%40biomantica.com.

--
~slg

[Sam Tobin-Hochstadt]

There is indeed signing for Ubuntu ppas, but that's specific both to apt and to the ppa system. 

Sam

To view this discussion on the web visit https://groups.google.com/d/msgid/racket-users/3b144b15-e5a1-8139-496d-c1a36e401117%40sagegerard.com.

[James Platt]

On Apr 2, 2021, at 6:59 PM, Alex Harsányi wrote:

> Hi James,
>
> If you are worried about dependency confusion attacks, you can set up your own package catalog on an internal server, delete the default catalogs from racket and add only a reference just your internal catalog. This way, "raco pkg install" will install all packages (and all their dependencies) only from a source which you have full control of.
>
> I use a similar technique when I build my application on the CI server, to ensure that all packages and their dependencies are under source control and no untracked dependency sneaks in via a new package dependency.

Thanks. I had not though of that. My company will probably want to do something of the kind before we release anything to the public.