make apt-key net-update secure

[Jamie Strandboge]

Attacks are being performed against the 'apt-key net-update' command and it is not considered secure. While it is in the process of being disabled in Ubuntu, it should be improved to be secure.

References:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/857472
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013639
http://seclists.org/fulldisclosure/2011/Sep/222
http://seclists.org/fulldisclosure/2012/Jun/267
http://seclists.org/fulldisclosure/2012/Jun/271
http://seclists.org/fulldisclosure/2012/Jun/289

[Michael Vogt (mvo)]

Here is a alternative approach for the net-update:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/857472/comments/2

[Michael Vogt (mvo)]

I would welcome feedback on the alternative approach. The idea is basicly to simply download a signed keyring file, gpg verify that against the master key and if its good, import it.

[Marc Deslauriers (mdeslaur)]

Subscribing Steve and Colin to get their feedback as well.

[Steve Langasek (vorlon)]

As I recall, we didn't go this route the first time around because we wanted to avoid changing the server-side interface. But if trying to check this securely is a case of being nibbled to death by cats, I think it makes sense to revisit this. So I have no objection to using a gpg-verified keyring object here.

[Marc Deslauriers (mdeslaur)]

More gpg issues with keyring files:

http://lists.gnupg.org/pipermail/gnupg-devel/2012-June/026743.html
http://lists.gnupg.org/pipermail/gnupg-devel/2012-June/026745.html
http://seclists.org/fulldisclosure/2012/Jun/349

[Jamie Strandboge (jdstrand)]

Some more info:
http://lists.gnupg.org/pipermail/gnupg-devel/2012-June/026724.html

[Colin Watson (cjwatson)]

I'm fine with the signed-keyring-file approach too, although I haven't confirmed that there are no attacks possible on the code used to verify *that* signature.

[Brian Murray (brian-murray)]

From #ubuntu-meeting on 2012-09-12:

08:43 < mvo> cjwatson: it will require a server side change
08:43 < mvo> cjwatson: if you guys are happy with the new proposed schema we can
             upload (once the server side is updated)
08:43 < mvo> but I (much) agree we should not rush this :) it caused enough pain
             already :/
08:45 < cjwatson> Of course I can't help with the server side change at the moment
                  because we don't have our sudo access back yet on pepo
08:45 < cjwatson> You'll probably have to ask webops

[Steve Langasek (vorlon)]

We're not going to get to this before quantal release.

[Colin Watson (cjwatson)]

http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg.sig exists now, so the client side should be unblocked.

[Michael Vogt (mvo)]

Thanks Colin, that is great news.

I updated the branch (and also merged the debian-sid changes) into https://github.com/mvo5/apt/tree/ubuntu/lp1013681 - I need to test it a bit more and then I will upload.

[Mathew Hodson (mhodson)]

Did this change ever make it in?

[Julian Andres Klode (juliank)]

No, it did not. We could rebase and merge it. We can also replace wget with /usr/lib/apt/apt-helper download-file to fix bug 325700 and bug 226780 while we're at it.

[Dimitri John Ledkov (xnox)]

Whilst poking all of this a while back, my thought was to use inline signed keyring snippet which is downloaded probably with the apt-helper, validated (well gpgv decrypt) and stored as /etc/apt/trusted.gpg.d/netupdate.gpg. Since we no longer need to touch /etc/apt/trusted.gpg keyring. This doesn't even need to live in apt-key netupdate, and could be just a timer unit. But i guess having this simple logic in apt-key script may make sense.

Note that netupdate has been disabled for a long while now, thus any reintroduction will need security team review before we enable.