<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.30.3">
</HEAD>
<BODY>
<BR>
<BLOCKQUOTE TYPE=CITE>
<PRE>
>> As a sidenote, I really dislike the fundamental design of waf:
>> Shipping a self-extracting scripting environment, obfuscated by an
>> odd format, and telling users to execute that code blindly. It is a
>> security risk!
>>
>> We really should extend the initial check to e.g. keep a checksum
>
>Do you mean keeping track of a checksum in cdbs source code ?
>If yes, it means we must keep an eye on every waf new release. I don't
>think it could work on long term.
I mean storing a checksum in e.g. debian/waf.sha1sum inside each source
package.
It might require updating each time there is a new upstream release,
yes. And not us, but the package maintainer need to keep an eye on it -
which is needed in any case due to the insecure design of waf. What we
offer is a mechanism to ensure it is not forgotten: I suggest that we
make the build routine FAIL if checksum does not match, which means the
package maintainer must do the needed security scrutiny each time the
waf blob changes, or explicitly do the foolish act of suppressing our
safety mechanism.
</PRE>
</BLOCKQUOTE>
<BR>
I added 2 checks in testsanity target :<BR>
1. check that debian/waf.sha1sum contains the word "waf"<BR>
2. sha1sum --check debian/waf.sha1sum<BR>
<BR>
but the packager still can do something like "sha1sum ./waf > debian/waf.sha1sum" on a malicious waf file.<BR>
The security is still not as strong as we would like, is it ?<BR>
Could we check the debian/waf.sha1sum is signed by the packager or something ?<BR>
<BR>
<BR>
regards<BR>
Rémi<BR>
<BR>
<BR>
<BR>
<BR>
</BODY>
</HTML>