Note that this change was submitted after the deadline, but since it can be shipped in an complete state, I am still processing it for Fedora 34.
== Summary ==
We want to add signatures to individual files that are part of shipped RPMs.
These signatures will use the Linux IMA (Integrity Measurement Architecture) scheme, which means they can be used to enforce runtime policies to ensure execution of only trusted files.
== Owner ==
* Name: [[User:Puiterwijk| Patrick Uiterwijk]]
* Email: puiterwijk@xxxxxxxxxx
* Name: [[User:Pbrobinson| Peter Robinson]]
* Email: pbrobinson@xxxxxxxxx
== Detailed Description ==
During signing builds, the files in it will be signed with IMA signatures..
These signatures will be made with a key that’s kept by the Fedora Infrastructure team, and installed on the sign vaults.
== Benefit to Fedora ==
Having all files signed with a verifiable key means that system owners can use the kernel Integrity and Measurement Architecture (IMA) to enforce only verified files can be executed, or define other policies.
== Scope ==
* Proposal owners:
The proposal owners will write the code for sigul to pass the required arguments, generate the keys in Infrastructure and get them deployed to the sign vaults.
* Other developers:
Nothing needed from other developers
* Release engineering:
A mass rebuild would be nice (as it ensures all packages are signed), but is not required to implement the change itself.
* Policies and guidelines:
No impact
* Trademark approval:
No impact
* Alignment with Objectives:
This aligns with the Internet of Things objective.
== Upgrade/compatibility impact ==
For standard Fedora users there will be no impact. If an advanced user was already signing their own files (for the Fedora shipped RPMs) for IMA functionality, they will just overwrite the existing signature.
== How To Test ==
The signatures can be tested “in vitro” by running `evmctl ima_verify --sigfile --key publiccert.der -v myfile.txt`.
This should result in the system reporting “<filename>: verification is OK”.
The full system could be tested by enrolling the Fedora IMA key to the kernel `_ima` keyring, and adding a policy that verifies (some) files to be verified against the key. (instructions to follow).
== User Experience ==
If the user deploys an IMA policy to verify all or some files, they should be able to trust the signatures made by the Fedora build system.
== Dependencies ==
No external package dependencies.
== Contingency Plan ==
* Contingency mechanism: If the change is not finished in time, we have probably not yet started signing new files. Signing can easily be disabled by updating the config file should issues arise.
If we did start signing, but haven’t signed everything, that is okay, since then packages will get signed as they’re bumped by developers, and they’ll be all signed in the next major release.
* Contingency deadline: We could ship with this feature in an unfinished state.
* Blocks release? No
* Blocks product? N/A
== Documentation ==
Documentation to follow.
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
