How to trust setup.exe?

[Achim Gratz]

Am 26.04.2019 um 18:28 schrieb Joel Rees:
> When bootstrapping a chain of trust, having multiple sources for the
> checksum values is significantly better than starting blind.

Except that checksums are at best providing evidence of tampering, not 
anchors of trust.

> I'm writing a blogpost on the use of multiple sources, using cygwin as
> an example, but the announcements for the updates of setup_xx.exe do
> not include the checksums.

The root of trust for setup.exe and the whole of the Cygwin installation 
is the GPG key for cygwin@cygwin.com and the integrity of the 
sourceware.org server hosting the original files, not the checksum of 
any of the files.  Those checksum files you are talking about are 
largely an artefact of how the sourceware.org servers are set up and are 
not meant to provide the assurances you seek.

https://cygwin.com/faq.html#faq.setup.install-security

> And the mirrors don't seem to keep
> setup_xx.exe. And the mirrors are all using .bz and .xz compression,
> which many MSWindowsboxes are not able to open without 3rd party help,
> which is a vicious cycle.

The mirrors are, as the name implies, mirrors, so any compression used 
is already there in the (non-public) repo the mirrors are distributing. 
The setup.ini file is also available uncompressed, though, expressedly 
so folks can read it without having to decompress anything.

> The blogpost:
> https://joels-programming-fun.blogspot.com/2019/04/bootstrapping-your-freedom-cygwin-gpg.html

That would need significant reorganization to become useful, IMHO.  But 
again, you're missing the whole point of what the trust anchor really is 
and how to verify it.  And yes, that bootstrapping step (obtaining and 
vetting setup.exe) would have to be done on a different system than the 
one you intend to install on if you are serious about it; although if 
you suspect that someone manipulates your system, then installing a 
clean Cygwin (assuming you succeed at it) onto that isn't really going 
to help matters.

> Would it be impossible to ask someone in the project to put the
> checksums in the announcements for setup?

Are you asking about the possibility of asking?

I'm not involved in releasing new setup.exe versions onto the server, so 
I can't comment on how much extra work it'd be to add the checksums to 
the announcement.

> And what about putting a regular zip compressed setup on the mirrors,
> so we can run certutil to check the checksum of the setup we run when
> we grab our first download, then grab gpg with a somewhat trusted
> system to use when checking the next version of setup that we
> download?

The way things work right now the mirrors don't need to be trusted with 
anything.  Distributing setup.exe over the mirrors would actually open a 
door to manipulation if a user can be tricked or forced into using only 
(one or a clique of) rogue mirror(s).

> It would not be a perfect chain, but without that we have nothing but
> broken links and reverse implications

Perfection is not attainable anyway.

-- 
Achim.

(on the road :-)


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple