Sign releases (gpg)

Aperta
  • Qualcosa non va?
#744 3 commenti 1 reazione 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
15/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Ferma
Ambito
release, security

Direzione di ricerca

The payload names no source files or tests; the work sits in the release process, not the Python code. Start by finding how the GitHub releases page and its artifacts are produced in the repository's release workflow or docs, and confirm whether a signing key already exists. Done means releases ship with a published GPG key, a signature or SHA256SUMS.asc file, and a docs page linked from the downloads page. Key custody needs maintainer input before any change.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement

Currently it is not possible to verify the authenticity or cryptographic integrity of the downoads from github.com because the releases are not cryptographically signed.

This makes it hard for your users to safely obtain the b2 software, and it introduces them (and potentially their servers) to watering hole attacks.

Steps to Reproduce
  1. Go to the releases page https://github.com/Backblaze/B2_Command_Line_Tool/releases
  2. Click download
  3. ???

Expected behavior: [What you expected to happen]

A few things are expected:

  1. I should be able to download the Backblaze release signing PGP key out-of-band from popular third-party keyservers (eg https://keys.openpgp.org/)
  2. I should be able to download a cryptographic signature of the release (or, better, the releases' digest file, such as a SHA256SUMS.asc file) along with the release itself
  3. The downloads page itself should include a link to the documentation page that describes how to do the above two steps

Actual behavior: [What actually happened]

There's just literally no information on verifying downloads, and it appears that it is not possible to do so.

Lingua principale
Python
Stelle
638
Fork
138
Merge medio
8h 27m
PR unite (30g)
8

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Backblaze/B2_Command_Line_Tool

Tutte le issue di Backblaze/B2_Command_Line_Tool

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.