Community Packages

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#39944 - [bind] root.hint fails checksum, useless use of signature

Attached to Project: Community Packages
Opened by Roman Neuhauser (roman-neuhauser) - Friday, 18 April 2014, 16:46 GMT
Last edited by Sébastien Luttringer (seblu) - Thursday, 15 May 2014, 22:35 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To Sébastien Luttringer (seblu)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

==> Making package: bind 9.9.5.W1-2 (Fri Apr 18 18:40:16 CEST 2014)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Retrieving sources...
-> Found bind-9.9.5-W1.tar.gz
-> Found bind-9.9.5-W1.tar.gz.asc
-> Found root.hint
-> Found tmpfiles.d
-> Found named.conf
-> Found named.service
-> Found named.logrotate
-> Found localhost.zone
-> Found 127.0.0.zone
==> Validating source files with sha1sums...
bind-9.9.5-W1.tar.gz ... Passed
bind-9.9.5-W1.tar.gz.asc ... Skipped
root.hint ... FAILED
tmpfiles.d ... Passed
named.conf ... Passed
named.service ... Passed
named.logrotate ... Passed
localhost.zone ... Passed
127.0.0.zone ... Passed
==> ERROR: One or more files did not pass the validity check!

PKGFILE downloads both the tarball and the .asc file from the same *http* url, the .asc file has 'SKIP' for checksum, and is used to verify authenticity of the tarball. that's completely useless: if an attacker gains enough access to ftp.isc.org to plant a tarball, surely they can plant a signature as well.
This task depends upon

Closed by  Sébastien Luttringer (seblu)
Thursday, 15 May 2014, 22:35 GMT
Reason for closing:  Not a bug
Comment by Sébastien Luttringer (seblu) - Monday, 05 May 2014, 23:04 GMT
The bind-9.9.5-W1.tar.gz.asc contains the signature by ISC key of the tarball.
Getting write access to ftp.isc.org, will not allows the attacker to sign the dirty tarball with the ISC key.
Comment by Roman Neuhauser (roman-neuhauser) - Tuesday, 06 May 2014, 09:03 GMT
yeah, sorry, i was sleep deprived and mixed signatures with checksums.

Loading...