4 ms·
Debian packages can be signed, so depending on how the signing keys are managed - it might have been much easier to find the underlying problem.
by captn3m0 6y ago
Debian packages can be signed, so depending on how the signing keys are managed - it might have been much easier to find the underlying problem.
- jrockway 6y agoTrue! I think since in the CI case you're bootstrapping a fresh machine for every build, you'd have to apt-key add their key as part of installing the package, so an attacker would just make a new one of those. I bet the compromise duration would have been shorter, though; there's got to be one engineer that installs the Debian package on their workstation and would be confused when their release system's signature stopped working. (And honestly, an attacker that can build a Debian package and update the public key for apt-key is probably harder to find than one that can edit a cleartext bash script. Security through hoping your adversaries can't perform tedious devops operations is no security at all, as they say, but in the real world it probably helps a tiny bit.)
- CameronNemo 6y agoI'm not above throwing public keys in the git repo for use in CI/CD jobs.