Web lists-archives.com

Re: How to trust setup.exe?




Am 26.04.2019 um 18:28 schrieb Joel Rees:
When bootstrapping a chain of trust, having multiple sources for the
checksum values is significantly better than starting blind.

Except that checksums are at best providing evidence of tampering, not anchors of trust.

I'm writing a blogpost on the use of multiple sources, using cygwin as
an example, but the announcements for the updates of setup_xx.exe do
not include the checksums.

The root of trust for setup.exe and the whole of the Cygwin installation is the GPG key for cygwin@xxxxxxxxxx and the integrity of the sourceware.org server hosting the original files, not the checksum of any of the files. Those checksum files you are talking about are largely an artefact of how the sourceware.org servers are set up and are not meant to provide the assurances you seek.

https://cygwin.com/faq.html#faq.setup.install-security

And the mirrors don't seem to keep
setup_xx.exe. And the mirrors are all using .bz and .xz compression,
which many MSWindowsboxes are not able to open without 3rd party help,
which is a vicious cycle.

The mirrors are, as the name implies, mirrors, so any compression used is already there in the (non-public) repo the mirrors are distributing. The setup.ini file is also available uncompressed, though, expressedly so folks can read it without having to decompress anything.

The blogpost:
https://joels-programming-fun.blogspot.com/2019/04/bootstrapping-your-freedom-cygwin-gpg.html

That would need significant reorganization to become useful, IMHO. But again, you're missing the whole point of what the trust anchor really is and how to verify it. And yes, that bootstrapping step (obtaining and vetting setup.exe) would have to be done on a different system than the one you intend to install on if you are serious about it; although if you suspect that someone manipulates your system, then installing a clean Cygwin (assuming you succeed at it) onto that isn't really going to help matters.

Would it be impossible to ask someone in the project to put the
checksums in the announcements for setup?

Are you asking about the possibility of asking?

I'm not involved in releasing new setup.exe versions onto the server, so I can't comment on how much extra work it'd be to add the checksums to the announcement.

And what about putting a regular zip compressed setup on the mirrors,
so we can run certutil to check the checksum of the setup we run when
we grab our first download, then grab gpg with a somewhat trusted
system to use when checking the next version of setup that we
download?

The way things work right now the mirrors don't need to be trusted with anything. Distributing setup.exe over the mirrors would actually open a door to manipulation if a user can be tricked or forced into using only (one or a clique of) rogue mirror(s).

It would not be a perfect chain, but without that we have nothing but
broken links and reverse implications

Perfection is not attainable anyway.

--
Achim.

(on the road :-)


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple