4 ms·

Unfortunately the GPG signing is worthless because there's no way of attaching trust to each key. So each package has been signed, but anyone could have issued

Unfortunately the GPG signing is worthless because there's no way of attaching trust to each key. So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same. Also, not all artifacts have sources and javadoc. Most do but some certainly don't.

wst_ 7y ago
So continuing this way GPG is worthless in general. Most of the keys you can't verify in person so there is no trust whatsoever. In this case Sonatype is verifying key for you. They will check if your key belongs to you and you are in control of your organization. Otherwise package would not be accepted. I may be wrong but source and javadoc are requirements. Maybe there are some old packages without it, but new ones should be complete.
- CamouflagedKiwi 7y ago
  Maybe they're historic and now it's a requirement, or maybe it's prereleases or something, but I have certainly seen some in the past. First one I can dig up: https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.0.0-beta-3/ https://repo1.maven.org/maven2/com/google/protobuf/protobuf-... The newer versions certainly do have sources and javadoc, but you can't assume their presence for everything.
Xylakant 7y ago
You could for example opt for TOFU. Then at least you’d be protected against a malicious takeover unless the attacker manages to access the maintainers private key. That’s been a pretty common issue in the recent past.
dtech 7y ago
> So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same. Not true. The GPG signature means the key belongs to an account with access to the group id (namespace, usually a domain), and that sonatype has verified the group id belongs to the original admin account for that group id. It's not a lot of guarantees, but you cannot just generate a GPG key, sign a package, and publish to maven central.
- CamouflagedKiwi 7y ago
  Anyone can issue a GPG key claiming to be whatever identity they want though. I've uploaded artifacts to Maven Central before and they didn't do any specific verification of the signing key - so if it just matches the domain that is no protection at all.

wst_ 7y ago

So continuing this way GPG is worthless in general. Most of the keys you can't verify in person so there is no trust whatsoever. In this case Sonatype is verifying key for you. They will check if your key belongs to you and you are in control of your organization. Otherwise package would not be accepted. I may be wrong but source and javadoc are requirements. Maybe there are some old packages without it, but new ones should be complete.

CamouflagedKiwi 7y ago
Maybe they're historic and now it's a requirement, or maybe it's prereleases or something, but I have certainly seen some in the past. First one I can dig up: https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.0.0-beta-3/ https://repo1.maven.org/maven2/com/google/protobuf/protobuf-... The newer versions certainly do have sources and javadoc, but you can't assume their presence for everything.

Xylakant 7y ago

You could for example opt for TOFU. Then at least you’d be protected against a malicious takeover unless the attacker manages to access the maintainers private key. That’s been a pretty common issue in the recent past.

dtech 7y ago

> So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same. Not true. The GPG signature means the key belongs to an account with access to the group id (namespace, usually a domain), and that sonatype has verified the group id belongs to the original admin account for that group id. It's not a lot of guarantees, but you cannot just generate a GPG key, sign a package, and publish to maven central.

CamouflagedKiwi 7y ago
Anyone can issue a GPG key claiming to be whatever identity they want though. I've uploaded artifacts to Maven Central before and they didn't do any specific verification of the signing key - so if it just matches the domain that is no protection at all.