OpenSAML v4.0.1 Artifacts in Central Repository

[Cantor, Scott]

On 4/23/21, 3:43 PM, "dev on behalf of Cris Rockwell" <dev-bounces at shibboleth.net on behalf of cmrockwe at umich.edu> wrote:

>    It's a super valuable conversation. You are absolutely right about the need to defend against supply attacks.In
> terms of what "Apache needs to understand," I hope I didn't give the wrong impression.
>  After all, I am just an individual committer to one of their projects. 

Yes, but ultimately you have a voice there and I don't, and you engaged and they didn't, so I'm just making the case for why we have a problem with how Central is used. Putting our artifacts there just doesn't end up getting people to do the right thing, so we don't.

>    What I think might work is adding this plugin to our project build

There are a lot of complexities that go into it, and my understanding is that no existing plugin "just works" to do this correctly but honestly...I haven't kept up and we haven't picked up the thread here to look at it lately so I don't know what state it's in.

But yes, that's the general idea.

>    Seems to verify signatures for all the dependencies.

And the latter one is ours, yes.

An issue with using Central fundamentally is that we are not putting anything there and we don't update it when we release new versions, including security releases.

I think the PMC is misguided in their philosophy and don't believe that "one place to get everything" is a workable model for anything, and that applies as much or more to GitHub, which has become just as bad. But that said, if their argument is that they have no reason to trust our repo, I can accept that except for the part where they're trusting one that's self-evidently not trustworthy (e.g., our artifacts are there, nobody but us has the "right" to put them there, yet they're there, ergo Central's model is fatally flawed).

-- Scott