<div dir="ltr"><div dir="ltr"><div>Hi Scott</div><div><br></div>It's a super valuable conversation. You are absolutely right about the need to defend against supply attacks.<div><div>In terms of what "Apache needs to understand," I hope I didn't give the wrong impression. </div><div>After all, I am just an individual committer to one of their projects. </div><div><br></div><div>What I think might work is adding this plugin to our project build</div><div></div><div><br></div><div><pre class="gmail-prettyprint" style="padding:2px;font-family:Monaco,Menlo,Consolas,"Courier New",monospace;font-size:13px;color:rgb(51,51,51);border-radius:4px;margin-top:0px;margin-bottom:20px;line-height:20px;word-break:break-all;white-space:pre-wrap;background-color:rgb(245,245,245);border:1px solid rgb(136,136,136)"><span class="gmail-pln" style="color:rgb(0,0,0)"> </span><span class="gmail-tag" style="color:rgb(0,0,136)"><plugin></span><span class="gmail-pln" style="color:rgb(0,0,0)">
</span><span class="gmail-tag" style="color:rgb(0,0,136)"><groupId></span><span class="gmail-pln" style="color:rgb(0,0,0)">org.simplify4u.plugins</span><span class="gmail-tag" style="color:rgb(0,0,136)"></groupId></span><span class="gmail-pln" style="color:rgb(0,0,0)">
</span><span class="gmail-tag" style="color:rgb(0,0,136)"><artifactId></span><span class="gmail-pln" style="color:rgb(0,0,0)">pgpverify-maven-plugin</span><span class="gmail-tag" style="color:rgb(0,0,136)"></artifactId></span><span class="gmail-pln" style="color:rgb(0,0,0)">
</span><span class="gmail-tag" style="color:rgb(0,0,136)"><executions></span><span class="gmail-pln" style="color:rgb(0,0,0)">
</span><span class="gmail-tag" style="color:rgb(0,0,136)"><execution></span><span class="gmail-pln" style="color:rgb(0,0,0)">
</span><span class="gmail-tag" style="color:rgb(0,0,136)"><goals></span><span class="gmail-pln" style="color:rgb(0,0,0)">
</span><span class="gmail-tag" style="color:rgb(0,0,136)"><goal></span><span class="gmail-pln" style="color:rgb(0,0,0)">check</span><span class="gmail-tag" style="color:rgb(0,0,136)"></goal></span><span class="gmail-pln" style="color:rgb(0,0,0)">
</span><span class="gmail-tag" style="color:rgb(0,0,136)"></goals></span><span class="gmail-pln" style="color:rgb(0,0,0)">
</span><span class="gmail-tag" style="color:rgb(0,0,136)"></execution></span><span class="gmail-pln" style="color:rgb(0,0,0)">
</span><span class="gmail-tag" style="color:rgb(0,0,136)"></executions></span><span class="gmail-pln" style="color:rgb(0,0,0)">
</span><span class="gmail-tag" style="color:rgb(0,0,136)"></plugin></span></pre></div><div><a href="https://www.simplify4u.org/pgpverify-maven-plugin/index.html">https://www.simplify4u.org/pgpverify-maven-plugin/index.html</a><br></div><div><br></div><div>Seems to verify signatures for all the dependencies.</div><div><br></div><div>[INFO] org.springframework:spring-jcl:jar:5.2.4.RELEASE PGP Signature OK<br> KeyId: 0xE2ACB037933CDEAAB7BF77D49A2C7A98E457C53D UserIds: [Spring Buildmaster <<a href="mailto:buildmaster@springframework.org">buildmaster@springframework.org</a>>]<br>[INFO] org.opensaml:opensaml-security-impl:jar:4.0.1 PGP Signature OK<br> KeyId: 0xF4FCEFBF07F9E397A9345B9D4D37705B61CB0B3F UserIds: [Brent Putman <<a href="mailto:putmanb@georgetown.edu">putmanb@georgetown.edu</a>>]<br><br></div><div>Regards</div><div>Cris</div><div><br></div><div><br></div><div><input name="virtru-metadata" type="hidden" value="{"email-policy":{"state":"closed","expirationUnit":"days","disableCopyPaste":false,"disablePrint":false,"disableForwarding":false,"enableNoauth":false,"persistentProtection":false,"expandedWatermarking":false,"expires":false,"isManaged":false},"attachments":{},"compose-id":"1","compose-window":{"secure":false}}"><div><br></div></div></div></div><br><div class="gmail_quote" style=""><div dir="ltr" class="gmail_attr">On Fri, Apr 23, 2021 at 1:27 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 4/23/21, 12:40 PM, "dev on behalf of Cris Rockwell" <<a href="mailto:dev-bounces@shibboleth.net" target="_blank">dev-bounces@shibboleth.net</a> on behalf of <a href="mailto:cmrockwe@umich.edu" target="_blank">cmrockwe@umich.edu</a>> wrote:<br>
<br>
> Has anything changed with respect to publishing artifacts to Maven Central as compared to the wiki?<br>
<br>
No.<br>
<br>
> Do you have any knowledge about how OpenSAML v4.0.1 artifacts were uploaded to Central in Feb 2021? <br>
<br>
No.<br>
<br>
> Is it still presumed these were modified in some way as the wiki suggests?<br>
<br>
The only presumption is that it's impossible to know without checking, and the project's view is that if you want to compare all the artfifacts instead of just getting them from the official source, or just ostrich away the issue (what most of the planet is doing), that's really not our call.<br>
<br>
We sign all our artifacts, so you should of course be able to tell (aside from comparing hashes) if theyr're actually the exact copies or if somebody re-signed them. Our PGP signing keys are published and we recently cleaned them up as well and fixed some weak keys.<br>
<br>
I am gratified, somewhat, that we have been proven entirely correct; the supply chain problems with Node.js and many other systems have demonstrated these risks are not theoretical. Maven Cental is simply a bad idea if there's no well-defined provenance and no in-band signature check in all builds. That should be evident to everybody, if it wasn't before.<br>
<br>
> Please let me know if you have any other suggestions.<br>
<br>
My main suggestion is that Apache needs to understand that you can't make Maven Central trustworthy simply by checking any given set of components at a given time and find that they're kosher. There is no way to sustain that state without checking every time a build happens.<br>
<br>
We have been considering a move to a maven plugin in the build to do that using pinned keys so that we could leverage Central, but I doubt we would care to move our code there since we have no funding for supporting other people using OpenSAML, and because our belief is that the majority of projects do not "get" this issue and would not use them safely. Our contribution to that is to force people into these conversations.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net" target="_blank">dev-unsubscribe@shibboleth.net</a><br>
</blockquote></div></div>