Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From: Maxwell Rees <maxcrees@me.com>
Mime-Version: 1.0 (1.0)
Subject: Re: How to protect repository's private key?
Date: Sat, 13 Jun 2020 16:52:42 -0500
Message-Id: <EF5EF49E-2FDD-43AC-9AE8-F56881A37B17@me.com>
References: <20200613212426.kqtzbohhnfme4lhn@wolfsden.cz>
Cc: ~alpine/devel@lists.alpinelinux.org
In-Reply-To: <20200613212426.kqtzbohhnfme4lhn@wolfsden.cz>
To: Wolf <wolf@wolfsden.cz>



> On Jun 13, 2020, at 4:24 PM, Wolf <wolf@wolfsden.cz> wrote:
>=20
> =EF=BB=BFHello,
>=20
> I'm trying to setup (well, actually update to 3.12) my private
> repository for alpine packages and I'm facing issues with how to protect
> repository signing key from rogue software.
>=20
> For example, if some shady code is executed as part of a Makefile or
> something, it does by default have read access to repository private key
> (and it can therefore extract it). I would like to prevent that.
>=20
> In 3.11, I was using fake dummy key in the build container,
> abuild-gzsplit and abuild-sign with the real key which worked fairly
> well. However, that is not possible in 3.12 since abuild-gzsplit is
> broken there.

This is something I have spent considerable time thinking about and the stra=
tegy you describe is basically what I have encoded in software that I've bee=
n developing called APK Foundry. It's basically abuild's rootbld feature bui=
lt out to support Gitlab CI and has some nice features like being able to ea=
sily reuse containers that rootbld doesn't really support. It generates a th=
rowaway key inside the container and can re-sign packages outside of the con=
tainer using the precious key for you. It's still a work in progress but it s=
hould be mostly usable out of the box for local building, just needs some do=
cumentation on how to get started quickly.

It sounds like abuild-gzsplit needs to be fixed then; you should file an iss=
ue on alpine/abuild.git.=20

> How is this issue usually solved? What approach does official Alpine
> repository takes? What approach do people with private repositories use?

I can't speak for Alpine but Ad=C3=A9lie doesn't have mitigations for this i=
n place yet; it is my hope that we will eventually adopt my software to fix t=
hat. As far as I know most developers with private repositories use either l=
xc/lxd, docker-abuild, or just build directly on the host (eww) and don't re=
ally consider these issues.=20

Max=