summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNorbert Preining <preining@logic.at>2016-04-12 06:06:52 +0000
committerNorbert Preining <preining@logic.at>2016-04-12 06:06:52 +0000
commit3b23fb4b0312101638bdfbbca296cca552f87793 (patch)
tree49cee86f5a89ad5244074b6707407624d7654e09
parentd6f5b1247ae1c4b2efa117de0d0f1b7fa8cf6207 (diff)
add security proposal document
git-svn-id: svn://tug.org/texlive/trunk@40425 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Master/tlpkg/doc/tl-security-proposal.txt62
1 files changed, 62 insertions, 0 deletions
diff --git a/Master/tlpkg/doc/tl-security-proposal.txt b/Master/tlpkg/doc/tl-security-proposal.txt
new file mode 100644
index 00000000000..87c9296cc24
--- /dev/null
+++ b/Master/tlpkg/doc/tl-security-proposal.txt
@@ -0,0 +1,62 @@
+Security Proposal for TeX Live
+==============================
+(last change NP 2016-01-03)
+
+We use md5 sums in the following places:
+1) md5sum of the texlive.tlpdb in texlive.tlpdb.md5 in tlnet/tlcritical
+ and all the normal dists
+2) md5 sum of *location* string of remote end
+ - if the database is present (tlpkg/texlive.tlpdb.MD5SUM) and the
+ md5sum downloaded from 1) and the saved md5sum agree, do not
+ redownload the remote tlpdb but use local copy
+3) md5sum of containers (.tar.xz)
+ are checked now only during installation, after my commit also
+ from tlmgr
+
+It would make sense to replace some or all of the above with sha256.
+2) is the only one we could keep as md5, but I propose that if
+we switch, then we switch all the md5 to sha256.
+
+In principle my idea about security setup is as follows:
+
+For the installer
+* installer packages are sha256 hashed (already done!)
+* the sha256 files are gpg signed with our gpg tlnet key
+* our public gpg key is included in texlive.infra package
+
+For the rest (installation or update from remote)
+* install-tl/tlmgr downloads the texlive.sha256.gpg and
+ texlive.sha256
+* verifies that this is ok
+* if yes, download the texlive.tlpdb and check the sha256
+ value of it (this is the reason we should switch from
+ md5 to sha256, as md5 is AFAIR fakeable)
+* if all succeed, do the usual verification of each
+ container only by sha256 (instead of md5)
+
+There is no need to sign each container, as we are having
+indirectly signed sha256 hashes of the containers
+(in the tlpdb, which is sha256-ed, and then signed).
+
+
+Transition notes:
+* I would like to have a start on this already *before*
+ 2016, but during 2015 we would have:
+ - if gpg is not available, or remote .sha256.gpg is not
+ available, silently continue (same behaviour as now)
+ After 2016 I suggest that if either of the above two
+ fail (gpg not available, or remote .sha256.gpg not
+ found), then tlmgr stops - unless --no-verification is
+ passed in or set in the tlmgr configuration file.
+* At least till after 2016 is released we need to generate
+ both texlvie.tlpdb.md5 and .sha256 on the remote server,
+ otherwise updates from versions before cannot verify
+ (hmm, maybe they can - as we do not break if there is
+ no md5 sum available - so maybe this is not necessary
+ at all and we can simply switch without any problem!)
+* gpg binaries:
+ for windows I guess we have to ship it, for all others
+ we should be able to assume that it is there. Those
+ who do not have access to gpg need to set --no-verification
+ in the configuration file.
+