On Wed, 07 Dec 2011 13:25:28 -0800
Adam Williamson <awilliam(a)redhat.com> wrote:
I'm not sure we can treat scratch / personal builds with *quite*
so
much abandon. They're still valuable targets for anyone trying to
compromise Fedora, after all.
I don't think you understand - we need to be able to reliably reproduce
them- sure - but we cannot count on them anymore than we do now. Ie:
someone sends an arbitrary pkg with arbitrary repos to supply its
buildreqs - we cannot trust the pkg at all.
That's ALWAYS true.
but we definitely cannot allow the above to build on our existing build
boxes.
Who uses scratch builds the most? Well, probably Fedora packagers,
right? And we probably wind up deploying them on our own systems after
we build them. That's what scratch builds are _for_ - testing your
stuff before pushing it out more widely.
And again - if you are testing your own pkgs - you'll be fine - there's
no insecurity there.
You trust you.
and the trust of the images you're building from is up to which cloud
service provider you have a contractual relationship with.
So it occurs to me that if we have a hilariously insecure system for
doing scratch builds, and someone really wants to do evil things to
Fedora, it's going to make their lives a lot easier.
I don't think you understand where the insecurity is in the system.
All they have to
do is compromise a provenpackager's scratch build to include some
kind of trojan, then when the provenpackager installs the scratch
build they just fired off, hey presto, the attacker has now
effectively gained provenpackager privileges. They can just hack into
the provenpackager's system using the back door they just trojaned in
there and go about making their nefarious changes to Fedora just as
if they were the trusted packager; they don't need to attack
'important' builds in-flight any more.
Let's put it this way - if we put such a system in place I'd damn well
be doing my scratch builds locally from then on. I wouldn't trust them
to Joe Q. Random's VM.
No one has EVER seriously considered a random person's VM.
ever.
but I do think a vm you create at ec2 or rax or wherever is just fine.
b/c YOU create it with a known good/trusted img as the base.
do you understand now?
-sv