From Fedora Project Wiki
Stop (medium size).png
DRAFT
This is just a DRAFT. We try and make sure the information here is up to date and correct, but please check before depending on it.


RPM Signature Checking During Installation

Summary

Back in the dawn of time, rpm grew the ability to check cryptographic signatures of a package. We've never used this during installation, because it was unclear where the root of trust would come from - there's no way to tell that the public keys are valid. That problem is now solvable.

Related bugs:

Owner

  • Email: pjones at redhat com

Current status

  • Targeted release: Fedora 19
  • Last updated: 23-Jun-2012
  • Percentage of completion: 20%


Detailed Description

Using the Secure Boot mechanism, we can make a UEFI binary, which for this discussion we'll call "Hello, World!", or "HW" for short. In that binary, we add an extra section that holds a list of public keys. We then get the binary signed with the UEFI signing service.

During installation, we verify the signature against the hardware keys. If the signature is invalid, we warn the user that something has gone horribly wrong. If it's valid, we extract the public keys from the binary using a simple tool, and we add them to the rpm database. We then run the anaconda transaction with keys in place.

Benefit to Fedora

No more risky installation from untrusted repositories.

Scope

  1. Write the small utility to generate the binary
  2. Write the small utility to verify the binary and extract the keys
  3. Get a new binary signed every time we change the signing keys.

How To Test

Standard installation should test that it's working. Invalid binaries are easily provided to test a negative cryptographic test.

User Experience

Substantially the same as current experience, but with a nice sense of security.

Dependencies

Contingency Plan

Contingency plan is current status quo.

Documentation

Not yet.

Release Notes

Comments and Discussion