<story><title>Deb.haskell.org Security Breach</title><url>https://status.haskell.org/</url></story><parent_chain></parent_chain><comment><author>kfreds</author><text>The most important information is missing - did the attackers get the package signing key? The comment &amp;quot;the window for package compromise was very very small&amp;quot; is a bit ambiguous.&lt;p&gt;That the security of package integrity is so fragile should greatly concern all of us. Almost all big Linux distributions rely on downloading compiled packages signed by a single key. If the build system is compromised your Linux distribution of choice will happily give you trojaned packages that you install as root. If the signing key is compromised a man-in-the-middle is required, but the difficulty to mount an attack is decreased due to the fact that most repositories don&amp;#x27;t transport over TLS.&lt;p&gt;The situation can be improved in many ways. By making the build process deterministic many parties can compile the same package and compare the result, alerting the community if one of the build systems report a different checksum. Package managers like apt and yum should be extended with the ability to rely on signatures from multiple parties.&lt;p&gt;The Tor Project, Debian and Fedora has started working on the first problem, but I don&amp;#x27;t know of any efforts to support multi-sig.&lt;p&gt;&lt;a href=&quot;https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.torproject.org&amp;#x2F;blog&amp;#x2F;deterministic-builds-part-o...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https://blog.torproject.org/blog/deterministic-builds-part-two-technical-details&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.torproject.org&amp;#x2F;blog&amp;#x2F;deterministic-builds-part-t...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https://wiki.debian.org/ReproducibleBuilds&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;wiki.debian.org&amp;#x2F;ReproducibleBuilds&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https://securityblog.redhat.com/2013/09/18/reproducible-builds-for-fedora/&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;securityblog.redhat.com&amp;#x2F;2013&amp;#x2F;09&amp;#x2F;18&amp;#x2F;reproducible-buil...&lt;/a&gt;</text></comment>
<story><title>Deb.haskell.org Security Breach</title><url>https://status.haskell.org/</url></story><parent_chain></parent_chain><comment><author>tdicola</author><text>I&amp;#x27;ve been looking at hosting some apt packages in a custom repo and am truly impressed&amp;#x2F;horrified by the layers of complexity necessary &amp;amp; suggested to create one.  It boggles my mind why an apt host has to be more than a static list of files that are hosted on S3, raw github, etc.  Running and maintaining a full blown server just to host some files seems crazy.</text></comment>