From: Hans Fugal <hfugal@...>
Date: 2004-06-26T00:18:06+09:00
Subject: Re: rubygems thoughts

Lennon Day-Reynolds wrote:
> As a temporary fix, why not have the URLs at which gems can be
> downloaded be derived from a secure hash (i.e., SHA digest) of the
> file? It doesn't guarantee that your downloaded gem listing hasn't
> been affected, but at least a given URL, once distributed as the
> download location, can easily be checked -- if the actual hash of the
> downloaded gem is the same as the hash component of the URL, you know
> that the version you downloaded is the one advertised.
> 
> Going further, imagine a system with multiple repositories that
> aggregate some reasonable number of packages -- let's say that
> ruby-lang.org, rubyforge.org, and sourceforge.net all have public
> package repositories set up, with a single public key for each
> repository. If the SHA hashes for each gem are part of the repository
> listing and URL at which it is downloaded, and the package listing
> file is signed by the repository administrator(s), then you can have a
> fairly secure distribution channel without a complex "web of trust".
> Just get the (presumably well-known and mirrored all over the place)
> public key for a repository, and you can download any package you like
> from it without much worry over tampering.
> 
> Anyone see any obvious attacks or holes?

As Mauricio said, a centralized system like you propose requires the 
repository to validate the packages. That almost always results in a 
bottleneck at the repository level. Just look at Debian. The packages 
are done by lots of volunteers, and let's assume we have enough 
volunteers to package the interesting programs. Why is Debian 
notoriously slow at releasing? Because of the stress on quality which 
boils down to some QA on the quality of the packages and distribution. 
I, for one, am happy running testing which is the same model without the 
repository bottleneck.

So if we want to avoid repository maintainer bottleneck, we want to make 
the developers (or gems packagers if they're different people) 
responsible for signing the package, if it is to be signed at all. The 
repository could automatically check signatures and add its own 
signature which gives us the benefit you mentioned.

A strong assurance that the package came from the maintainer can be had 
if you have a web of trust. Most people aren't that paranoid though, and 
they're happy with verifying that the hash matches what's on the 
website. I for one am less concerned with the repository getting hacked 
(that's likely to be noticed before I get bitten by it even if happens), 
than with someone taking advantage of an unprotected upload scheme.