Sign releases (gpg)

Abierto
  • ¿Algo no está bien?
#744 3 comentarios 1 reacción 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
15/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Estancado
Área
release, security

Línea de trabajo

The payload names no source files or tests; the work sits in the release process, not the Python code. Start by finding how the GitHub releases page and its artifacts are produced in the repository's release workflow or docs, and confirm whether a signing key already exists. Done means releases ship with a published GPG key, a signature or SHA256SUMS.asc file, and a docs page linked from the downloads page. Key custody needs maintainer input before any change.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement

Currently it is not possible to verify the authenticity or cryptographic integrity of the downoads from github.com because the releases are not cryptographically signed.

This makes it hard for your users to safely obtain the b2 software, and it introduces them (and potentially their servers) to watering hole attacks.

Steps to Reproduce
  1. Go to the releases page https://github.com/Backblaze/B2_Command_Line_Tool/releases
  2. Click download
  3. ???

Expected behavior: [What you expected to happen]

A few things are expected:

  1. I should be able to download the Backblaze release signing PGP key out-of-band from popular third-party keyservers (eg https://keys.openpgp.org/)
  2. I should be able to download a cryptographic signature of the release (or, better, the releases' digest file, such as a SHA256SUMS.asc file) along with the release itself
  3. The downloads page itself should include a link to the documentation page that describes how to do the above two steps

Actual behavior: [What actually happened]

There's just literally no information on verifying downloads, and it appears that it is not possible to do so.

Lenguaje dominante
Python
Estrellas
638
Forks
138
Merge medio
8 h 27 min
PR fusionados (30 d)
8

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Backblaze/B2_Command_Line_Tool

Todos los issues de Backblaze/B2_Command_Line_Tool

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.