GNU bug report logs - #41907
[security] Substitutes fetched from server with no authorized key

Previous Next

Full log

View this message in rfc822 format

From: Julien Lepiller <julien <at> lepiller.eu>
To: 41907 <at> debbugs.gnu.org, mail <at> ambrevar.xyz
Subject: bug#41907: [security] Substitutes fetched from server with no authorized key
Date: Wed, 17 Jun 2020 07:05:42 -0400

Le 17 juin 2020 03:37:35 GMT-04:00, Pierre Neidhardt <mail <at> ambrevar.xyz> a écrit :
>I could be doing something wrong, but...
>
>1. Alice starts `guix publich -u ambrevar`.
>2. Bob, who did _not_ authorize Alice's  signing key:
>   - herd stop guix-daemon
>- guix-daemon --build-users-grouop=guixbuild
>--substitute-urls='http://10.0.0.4:8080 https://ci.guix.gnu.org'
>   - guix build curl
>
>Result:
>
>--8<---------------cut here---------------start------------->8---
>downloading from http://10.0.0.4:8080/nar/gzip/...
>--8<---------------cut here---------------end--------------->8---
>
>Guix commit 8b00728144d0e4bbc740e1595c85f0ecee3f6fb0.
>
>Am I missing something or there is something really wrong?

There are two ways that you can get substitutes from unauthorized servers:

Substitutes for fixed-output derivations: guix lredy knows the result, so it doesn't need a signature, it checks the result (not sure this is a thing)

Substitutes that are reproducible. If you have a narinfo from an authorized build farm for a package in your local cache and alice's publish server proposes the same (name and checksum) substitute, you can download it. This is definitely a thing.

Other than that, guix should not use alice's substitutes.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.