Hacker News Reader

Comment by tomcam | Hacker News Reader

I don't know this area, but it seems to me it might be a boon to security? So that you can tell if components have been tampered with?

View on HN

That's already been a thing in all the Redhat variants. RPM/DNF have checksums of the installed binaries and there is GPG signing of packages and repositories. The only part of that ecosystem I've always had a gripe with is putting the GPG public keys in the mirrors. People should have to grab those from non mirrors or any low skilled attacker can just replace the keys and sign everything again. It would be caught but not right away.

Changes can also be caught using bolt on tools like Tripwire, OSSEC and it's alternatives or even home grown tools that build signed manifests of approved packages usually for production approval.

Yes! The attack on SolarWinds Orion was an attack on its build process. A verified reproducible build would have detected the subversion, because the builds would not have matched (unless the attackers managed to detect and break into all the build processes).

Exact same binary can be hacked in exact same way on all platforms.

What?

If I understand correctly that would require releasing the publisher’s private key, though，correct?

Only if you try to reproduce the signature. Usually the signature is stored separately. That way, the reproduced work's signature applies to it as well.

That would requiring breaking each of the separate build processes, which is very unlikely.

This doesn't counter subverted source code, that's not what reproduciblrle builds are for.

Bingo. We caught a virus tampering with one of our code gens this way.

for related, see Ken Thompson:

http://genius.cat-v.org/ken-thompson/texts/trusting-trust/

Reply on news.ycombinator.com