Re: pkgng suggestion: renaming /usr/sbin/pkg to /usr/sbin/pkg-bootstrap

On Sat, Aug 25, 2012 at 06:34:43PM -0500, CyberLeo Kitsana wrote:
> On 08/24/2012 07:01 PM, Baptiste Daroussin wrote:
> > Can anyone give me he details on the security related problem?

> Off the top of my head, it seems to represent a break in the chain of
> trust: how does the bootstrapper verify that the tarball it just
> downloaded to bootstrap pkg is genuine, and not, for example, a
> trojan? The source in usr.sbin/pkg/pkg.c[1] doesn't seem to suggest it
> cares.

Indeed it does not care, and the current security features are
insufficient (unless the bootstrapper can use the signed sqlite db to
verify the pkg package).

I think the fix is to modify 'pkg repo' so it detects the pkg package
and creates a separate signature for it which can be verified by the
bootstrapper, without needing sqlite.

The public key for this signature will have to be distributed with base
(like the public keys for freebsd-update and portsnap).

-- 
Jilles Tjoelker