[Rpm-maint] [rpm-software-management/rpm] Adding/moving RPMTAG_PUBKEYS to the signature header (#182)

[Jeff Johnson]

RPM package files can include public keys in the metadata header.

So in principle, a package can include the public key used to sign a package and verify the package signature when reading package headers. The RPMTAG_PUBKEYS array is also within the signed immutable region and cannot be altered in signed package metadata.

However, there is a chicken <-> egg problem extracting RPMTAG_PUBKEYS from the not-yet-verified metadata header blob in order to verify the header blob before loading.

Adding/moving RPMTAG_PUBKEYS to the signature header would permit a stronger (than RPMSIGTAG_SHA1) check on the header-only (or header+payload if you insist) metadata blob before loading the metadata header.

(aside)
Verifying the metadata header signature before loading also avoids the need for explicitly implementing stronger digests like RPMSIGTAG_SHA256: the signature itself determines the metadata digest, and -- unlike an additional digest included in the signature header which can be replaced -- is a cryptographically stronger verification.

(aside)
This is mostly a notification of the reason why RPMTAG_PUBKEYS is likely to appear soon in signature headers produced by RPM5 in order to support MANDATORY signature verification.


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/182
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20170327/04a055a0/attachment.html>