OpenSAML v4.0.1 Artifacts in Central Repository

[Cris Rockwell]

Hi Scott

It's a super valuable conversation. You are absolutely right about the need
to defend against supply attacks.
In terms of what "Apache needs to understand," I hope I didn't give the
wrong impression.
After all, I am just an individual committer to one of their projects.

What I think might work is adding this plugin to our project build

     <plugin>
        <groupId>org.simplify4u.plugins</groupId>
        <artifactId>pgpverify-maven-plugin</artifactId>
        <executions>
            <execution>
                <goals>
                    <goal>check</goal>
                </goals>
            </execution>
         </executions>
      </plugin>

https://www.simplify4u.org/pgpverify-maven-plugin/index.html

Seems to verify signatures for all the dependencies.

[INFO] org.springframework:spring-jcl:jar:5.2.4.RELEASE PGP Signature OK
       KeyId: 0xE2ACB037933CDEAAB7BF77D49A2C7A98E457C53D UserIds: [Spring
Buildmaster <buildmaster at springframework.org>]
[INFO] org.opensaml:opensaml-security-impl:jar:4.0.1 PGP Signature OK
       KeyId: 0xF4FCEFBF07F9E397A9345B9D4D37705B61CB0B3F UserIds: [Brent
Putman <putmanb at georgetown.edu>]

Regards
Cris




On Fri, Apr 23, 2021 at 1:27 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 4/23/21, 12:40 PM, "dev on behalf of Cris Rockwell" <
> dev-bounces at shibboleth.net on behalf of cmrockwe at umich.edu> wrote:
>
> >    Has anything changed with respect to publishing artifacts to Maven
> Central as compared to the wiki?
>
> No.
>
> >    Do you have any knowledge about how OpenSAML v4.0.1 artifacts were
> uploaded to Central in Feb 2021?
>
> No.
>
> >    Is it still presumed these were modified in some way as the wiki
> suggests?
>
> The only presumption is that it's impossible to know without checking, and
> the project's view is that if you want to compare all the artfifacts
> instead of just getting them from the official source, or just ostrich away
> the issue (what most of the planet is doing), that's really not our call.
>
> We sign all our artifacts, so you should of course be able to tell (aside
> from comparing hashes) if theyr're actually the exact copies or if somebody
> re-signed them. Our PGP signing keys are published and we recently cleaned
> them up as well and fixed some weak keys.
>
> I am gratified, somewhat, that we have been proven entirely correct; the
> supply chain problems with Node.js and many other systems have demonstrated
> these risks are not theoretical. Maven Cental is simply a bad idea if
> there's no well-defined provenance and no in-band signature check in all
> builds. That should be evident to everybody, if it wasn't before.
>
> >    Please let me know if you have any other suggestions.
>
> My main suggestion is that Apache needs to understand that you can't make
> Maven Central trustworthy simply by checking any given set of components at
> a given time and find that they're kosher. There is no way to sustain that
> state without checking every time a build happens.
>
> We have been considering a move to a maven plugin in the build to do that
> using pinned keys so that we could leverage Central, but I doubt we would
> care to move our code there since we have no funding for supporting other
> people using OpenSAML, and because our belief is that the majority of
> projects do not "get" this issue and would not use them safely. Our
> contribution to that is to force people into these conversations.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20210423/0571bc22/attachment-0001.htm>