[security] Substitutes fetched from server with no authorized key

I could be doing something wrong, but...

1. Alice starts `guix publich -u ambrevar`.

2. Bob, who did _not_ authorize Alice's signing key:

- herd stop guix-daemon

- guix-daemon --build-users-grouop=guixbuild --substitute-urls='http://10.0.0.4:8080 https://ci.guix.gnu.org'

- guix build curl

Result:

Guix commit 8b00728144d0e4bbc740e1595c85f0ecee3f6fb0.

Am I missing something or there is something really wrong?

--

Pierre Neidhardt

Le 17 juin 2020 03:37:35 GMT-04:00, Pierre Neidhardt <mail@ambrevar.xyz> a écrit :

There are two ways that you can get substitutes from unauthorized servers:

Substitutes for fixed-output derivations: guix lredy knows the result, so it doesn't need a signature, it checks the result (not sure this is a thing)

Substitutes that are reproducible. If you have a narinfo from an authorized build farm for a package in your local cache and alice's publish server proposes the same (name and checksum) substitute, you can download it. This is definitely a thing.

Other than that, guix should not use alice's substitutes.

Oh, that makes sense!

This is very smart actually!

Thanks a lot for the explanation!

--

Pierre Neidhardt

close 41907

quit

tags 41907 + notabug

quit