GNU bug report logs - #41907
[security] Substitutes fetched from server with no authorized key

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 41907 in the body.
You can then email your comments to 41907 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Pierre Neidhardt <mail <at> ambrevar.xyz>
To: bug-guix <at> gnu.org
Subject: [security] Substitutes fetched from server with no authorized key
Date: Wed, 17 Jun 2020 09:37:35 +0200

[Message part 1 (text/plain, inline)]

I could be doing something wrong, but...

1. Alice starts `guix publich -u ambrevar`.
2. Bob, who did _not_ authorize Alice's  signing key:
   - herd stop guix-daemon
   - guix-daemon --build-users-grouop=guixbuild --substitute-urls='http://10.0.0.4:8080 https://ci.guix.gnu.org'
   - guix build curl

Result:

--8<---------------cut here---------------start------------->8---
downloading from http://10.0.0.4:8080/nar/gzip/...
--8<---------------cut here---------------end--------------->8---

Guix commit 8b00728144d0e4bbc740e1595c85f0ecee3f6fb0.

Am I missing something or there is something really wrong?

-- 
Pierre Neidhardt
https://ambrevar.xyz/

[signature.asc (application/pgp-signature, inline)]

Message #8 received at 41907 <at> debbugs.gnu.org (full text, mbox):

From: Julien Lepiller <julien <at> lepiller.eu>
To: bug-guix <at> gnu.org, Pierre Neidhardt <mail <at> ambrevar.xyz>,
 41907 <at> debbugs.gnu.org
Subject: Re: bug#41907: [security] Substitutes fetched from server with no
 authorized key
Date: Wed, 17 Jun 2020 07:05:42 -0400

Le 17 juin 2020 03:37:35 GMT-04:00, Pierre Neidhardt <mail <at> ambrevar.xyz> a écrit :
>I could be doing something wrong, but...
>
>1. Alice starts `guix publich -u ambrevar`.
>2. Bob, who did _not_ authorize Alice's  signing key:
>   - herd stop guix-daemon
>- guix-daemon --build-users-grouop=guixbuild
>--substitute-urls='http://10.0.0.4:8080 https://ci.guix.gnu.org'
>   - guix build curl
>
>Result:
>
>--8<---------------cut here---------------start------------->8---
>downloading from http://10.0.0.4:8080/nar/gzip/...
>--8<---------------cut here---------------end--------------->8---
>
>Guix commit 8b00728144d0e4bbc740e1595c85f0ecee3f6fb0.
>
>Am I missing something or there is something really wrong?

There are two ways that you can get substitutes from unauthorized servers:

Substitutes for fixed-output derivations: guix lredy knows the result, so it doesn't need a signature, it checks the result (not sure this is a thing)

Substitutes that are reproducible. If you have a narinfo from an authorized build farm for a package in your local cache and alice's publish server proposes the same (name and checksum) substitute, you can download it. This is definitely a thing.

Other than that, guix should not use alice's substitutes.

Message #14 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Pierre Neidhardt <mail <at> ambrevar.xyz>
To: Julien Lepiller <julien <at> lepiller.eu>, bug-guix <at> gnu.org,
 41907 <at> debbugs.gnu.org
Subject: Re: bug#41907: [security] Substitutes fetched from server with no
 authorized key
Date: Wed, 17 Jun 2020 13:51:46 +0200

[Message part 1 (text/plain, inline)]

Oh, that makes sense!
This is very smart actually!

Thanks a lot for the explanation!

-- 
Pierre Neidhardt
https://ambrevar.xyz/

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.