3 ms·

Now that GitHub has CI and MSFT money, it would make so much sense for GitHub to become a code signing CA! With npm, you can opt in to have your npm package re

by Ayesh 3y ago

Now that GitHub has CI and MSFT money, it would make so much sense for GitHub to become a code signing CA! With npm, you can opt in to have your npm package releases signed, and it took less than five minutes for me to integrate. As long as the package is published with GitHub Actions (or other supported CIs I guess), you can sign the package and npmjs shows it as well. Git also has release and commit signing with gpg/ssh keys, so the authentication is already solved. https://github.blog/2023-04-19-introducing-npm-package-provenance/ https://github.blog/2023-04-19-introducing-npm-package-prove...

ikekkdcjkfke 3y ago
That's still a single point of failure, so the signing doesn't provide any extra security
- woodruffw 3y ago
  All PKI schemes have multiple singular points of failure: the user and system trust stores, the root CAs, the end-entity certificate, the security of all hosts, &c. Singular points of failure aren’t inherently an issue; the bigger concern is how strong each point is.
toastal 3y ago
Sounds like Microsoft… you get Microsoft npm releases signed if you use Microsoft GitHub Actions. Deployed to Microsoft Azure, built with Microsoft GitHub Codespaces enhanced with Microsoft GitHub Copilot, all from your Microsoft Windows machine. Folks shouldn’t be forced to use proprietary software from US-based, publicly-traded megacorporotations just to build & sign their libre software.
charcircuit 3y ago
These code certs verify the orginization who created the executable. Those are not the same guarentees as a signature for a commit.
- Too 3y ago
  If the GitHub action only takes the source repo itself as input, you can review the state of the repo, including the .github/workflows to ensure that the executable was created consistently from given commit. This assumes the actions are not downloading content from other places, which I’m not sure is easy to enforce given prevalence of package managers. Meaning workflows has to be reviewed manually for such.
  - layer8 3y ago
    If a non-technical end user installs malware, it doesn't help them that they could have inspected the source commit of said malware.
  - charcircuit 3y ago
    1. Buy compromised github account 2. Create public repo with just an exe of malware and whatever is needed to setup the action 3. Download the signed exe 4. Delete the repo 5. Repeat It doesn't mean much.
layer8 3y ago
Code signing certificates are supposed to assure that the owner of the key has been verified to be a specific legal entity (person or organization), and also to assure a certain level of protection of the private key, such as being managed by an HSM. NPM signing or SSH keys don't provide any such assurance.
- withinboredom 3y ago
  Hmm... my github org, owned by my business has my business's tax information (and verified), as well as my business billing information. It sounds like they should be reasonably confident that the org is my business.

by Ayesh 3y ago

ikekkdcjkfke 3y ago

That's still a single point of failure, so the signing doesn't provide any extra security

woodruffw 3y ago
All PKI schemes have multiple singular points of failure: the user and system trust stores, the root CAs, the end-entity certificate, the security of all hosts, &c. Singular points of failure aren’t inherently an issue; the bigger concern is how strong each point is.

toastal 3y ago

Sounds like Microsoft… you get Microsoft npm releases signed if you use Microsoft GitHub Actions. Deployed to Microsoft Azure, built with Microsoft GitHub Codespaces enhanced with Microsoft GitHub Copilot, all from your Microsoft Windows machine. Folks shouldn’t be forced to use proprietary software from US-based, publicly-traded megacorporotations just to build & sign their libre software.

charcircuit 3y ago

These code certs verify the orginization who created the executable. Those are not the same guarentees as a signature for a commit.

Too 3y ago
If the GitHub action only takes the source repo itself as input, you can review the state of the repo, including the .github/workflows to ensure that the executable was created consistently from given commit. This assumes the actions are not downloading content from other places, which I’m not sure is easy to enforce given prevalence of package managers. Meaning workflows has to be reviewed manually for such.
- layer8 3y ago
  If a non-technical end user installs malware, it doesn't help them that they could have inspected the source commit of said malware.
- charcircuit 3y ago
  1. Buy compromised github account 2. Create public repo with just an exe of malware and whatever is needed to setup the action 3. Download the signed exe 4. Delete the repo 5. Repeat It doesn't mean much.

layer8 3y ago

Code signing certificates are supposed to assure that the owner of the key has been verified to be a specific legal entity (person or organization), and also to assure a certain level of protection of the private key, such as being managed by an HSM. NPM signing or SSH keys don't provide any such assurance.

withinboredom 3y ago
Hmm... my github org, owned by my business has my business's tax information (and verified), as well as my business billing information. It sounds like they should be reasonably confident that the org is my business.