Opened 2 years ago

Closed 2 years ago

Last modified 2 years ago

#751 closed enhancement (fixed)

update-smart-drivedb should authenticate the downloaded file

Reported by: Christian Franke Owned by: Christian Franke
Priority: major Milestone: Release 6.6
Component: drivedb Version: 6.5
Keywords: Cc:

Description

The update-smart-drivedb script does not authenticate the downloaded drivedb.h file. At least the smartmontools packages from Debian and Ubuntu do no longer provide this script due to security concerns (see Debian Bug 804299).

A check with GnuPG could be added as follows:

  • Add missing drivedb branches for recent release (e.g. RELEASE_6_5_DRIVEDB) and for current trunk (RELEASE_6_6_DRIVEDB). Then the fallback to a download from trunk is no longer needed.
  • Create a new signing key for drive database files.
  • Add signature files drivedb.h.raw.asc to each maintained branch. These are generated from versions of drivedb.h with unexpanded SVN "$Id$" strings. No such file is needed for the trunk.
  • Modify the update-smart-drivedb script such that it downloads drivedb.h and drivedb.h.raw.asc always from the correct branch and then verifies the signature with GPG. The public key could be kept in the script itself.

When changes to the trunk version of the database are later merged to all maintained branches, the signature files could be updated with the same commit. Only these commits will require access to the private key.

Change History (4)

comment:1 Changed 2 years ago by Christian Franke

Milestone: Release 6.6
Owner: set to Christian Franke
Status: newaccepted

comment:2 Changed 2 years ago by Christian Franke

Resolution: fixed
Status: acceptedclosed

comment:3 Changed 2 years ago by Christian Franke

comment:4 Changed 2 years ago by Christian Franke

The new update script could also be used for older smartmontools releases.
Example (see also r4362):

$ ./configure --prefix=/usr [...--other...] --with-update-smart-drivedb=5.43
...
$ make update-smart-drivedb update-smart-drivedb.8
...
$ sudo ./update-smart-drivedb
/usr/share/smartmontools/drivedb.h updated from branches/RELEASE_5_43_DRIVEDB
Note: See TracTickets for help on using tickets.