.png){kind=small}
This is just a DRAFT. We try and make sure the information here is up to date and correct, but please check before depending on it.
RPM Signature Checking During Installation
Summary
Back in the dawn of time, rpm grew the ability to check cryptographic signatures of a package. We've never used this during installation, because it was unclear where the root of trust would come from - there's no way to tell that the public keys are valid. That problem is now solvable.
Related bugs:
Owner
- Name: Peter Jones
- Email: pjones at redhat com
Current status
- Targeted release: Fedora 19
- Last updated: 23-Jun-2012
- Percentage of completion: 20%
Detailed Description
Using the Secure Boot mechanism, we can make a UEFI binary, which for this discussion we'll call "Hello, World!", or "HW" for short. In that binary, we add an extra section that holds a list of public keys. We then get the binary signed with the UEFI signing service.
During installation, we verify the signature against the hardware keys. If the signature is invalid, we warn the user that something has gone horribly wrong. If it's valid, we extract the public keys from the binary using a simple tool, and we add them to the rpm database. We then run the anaconda transaction with keys in place.
Benefit to Fedora
No more risky installation from untrusted repositories.
Scope
- Write the small utility to generate the binary
- Write the small utility to verify the binary and extract the keys
- Get a new binary signed every time we change the signing keys.
How To Test
Standard installation should test that it's working. Invalid binaries are easily provided to test a negative cryptographic test.
User Experience
Substantially the same as current experience, but with a nice sense of security.
Dependencies
- pesign will provide utilities for doing this which it doesn't have yet.
- https://fedoraproject.org/wiki/Features/SecureBoot
Contingency Plan
Contingency plan is current status quo.
Documentation
Not yet.