[linux-elitists] Rooted kernel.org hosts (was: PJ takes her victory lap)
rick at linuxmafia.com
Wed Aug 31 21:22:47 PDT 2011
Quoting Greg KH (greg at kroah.com):
> As hera was the machine that was compromised, tarballs could be changed
> and properly signed, so pgp signatures mean nothing here.
Ah, I had assumed, apparently in error, that the private key +
passphrase would be used for code-signing _only_ on a more carefully
guarded machine, not on a shared host (which is what I gather hera to
be). That is typically how such things are done, specifically to render
the signed tarballs insensitive to compromise of the public host.
Yes, the git repo is naturally the reference for kernel developers.
However, it would be excellent if tarball signing were, in future, done
in such a way as to give more meaningful security assurance than just
'this mirror accurately reflects whatever the ftp master has'.
(BTW, if you're busy on the forensics, by all means please don't let me
waste any of your time.)
More information about the linux-elitists