Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Fedora uses GPG-keys for signing RPM packages and ISO checksum files. They list the keys in use (including fingerprints) on a web page. The web page is delivered via https.

For example the checksum file for Fedora-16-i386-DVD.iso is signed with key A82BA4B7. Checking who signed the public key results in a disappointing listing:

Type bits/keyID    cr. time   exp time   key expir

pub  4096R/A82BA4B7 2011-07-25            

uid Fedora (16) 
sig  sig3  A82BA4B7 2011-07-25 __________ __________ [selfsig]

It seems that nobody from the Fedora community has signed these important keys!

Why? ;) (Why doesn't Fedora use a web of trust?) Or am I missing something?

Compare this e.g. with Debian - their current automatic ftp signing key 473041FA is signed by 7 developers.

Edit: Why does this stuff matter?

Having such an important key signed by real people (currently it is not signed by anyone!) established a certain level of confidence that it is the real key and not one created by an attacker just uploaded 5 minutes ago to the web-server. This level of confidence or trust requires that you can trace signing relations in a web of trust (to people you are already trusting). And the probability you are being able to do so is increasing when different people sign it (currently the probability is zero).

You can compare this trust thing with surfing to https://mybank.example.net and getting a certification verification warning - would you then still enter your transaction details or would you think 'wait a minute!', stop and investigate the issue?

share|improve this question
    
what is it you are hoping to see? What is the added value you feel you will get from having more signatories? Not being awkward here, but just trying to understand what you need. –  Rory Alsop Feb 21 '12 at 9:56
    
@RoryAlsop, updated the question to give some motivation. –  maxschlepzig Feb 22 '12 at 8:13
    
SSL certificates are far from perfect. (I'm sure there are other reports; these are just what I found with a very quick search-and-scan through my recent personal blog archives.) –  Michael Kjörling Feb 22 '12 at 13:00
1  
@MichaelKjörling, nobody claims that SSL certificates (or current TLS revisions/implementations) are perfect. Please clarify how your comment is related to the issue described in the question. –  maxschlepzig Feb 22 '12 at 19:25
2  
Avid Fedora user, and I'm with you max. I wasn't shocked when I downloaded the key for Tails and it wasn't signed, but Fedora is put together by tons of competent and even many beardful individuals (many being RHT employees). Pretty odd. Probably better to ask this in one of the IRC chatrooms. Or at fedoraforum or askfedora. –  ryran Mar 4 '12 at 19:40
add comment

1 Answer

I can't speak to the specific rationale of the Fedora developers, but unless you trust the signing keys it doesn't make a difference.

One ought not blindly trust an individual's key without having met face-to-face and exchanged keys or having received their signed key from a third party one trusts absolutely.

Being that the Fedora user community is relatively large compared to the Fedora developer community, wide distribution and rational trust of the signers is unlikely for the general public though it would add some value for the small number of people able to properly trust the signer(s).

In the case of SSL this secure key exchange has already taken place -- it is performed on your behalf by your browser or OS vendor. Common Certificate Authority root (and issuing) public keys come pre-populated in your SSL trust db. Much like SSL root certs, the signing keys for various OS repositories come with the distribution. Thus there is no basis to say that these SSL root certificates are more or less trustable than the GPG signing keys distributed with your OS.

GPG signing of packages still provides substantial benefit even without a signed key. You can be assured that your packages came from the same source, you can be sure if the signing key has changed any point since installing, etc. You can also look to other places the key might be published and check to see if it's different.

This has the net effect of giving you the ability to say "if I were rooted via a signed package, everyone else using Fedora is also rooted" whereas with unsigned packages a paranoid mind must always ask "what if someone is sitting between me and the mirror on the network and slipstreaming nefarious code into any *.{rpm,deb,txz}?".

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.