Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am researching a way to protect, and enable accountability of, our packages when being transferred from our dev team, through to Q+A and eventually to deployment.

I have initially created a signing box that our devs can log on to and sign the rpm's using their GnuPG created key. They then move the signed package to an 'outbox' directory for QA to pick up, and move their public portion of the key to a 'public key' directory. This however is not ideal as multiple (fake) public keys can be made by each user...

The ultimate aim is to force each completed package to be signed by a single developer to ensure accountability and integrity as the package moves to our operations platform.

Therefore, I have a few areas that I need help/suggestions with:

  • What is the best way to ensure only one key is made by each user? (A script maybe?)
  • What is the best way to store and retrieve these keys that ensures integrity?

Many thanks.

share|improve this question
add comment

1 Answer

You cannot prevent anybody from creating a new key pair. But you can maintain a list of "allowed key pairs" where you insert only one key pair per developer, and whenever you validate a signed rpm, you use that list as your trust base.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["        <li><a href=\"http://area51.stackexchange.com\" title=\"proposing new sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"http://careers.stackoverflow.com\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2014 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a> \r\n                with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2014.4.18.1558\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Information Security Stack Exchange works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"d"], "copyright__copyright__copyright": ["uestion\nadd comment\n\n1 Answer\n\nYou cannot prevent anybody from creating a new key pair. But you can maintain a list of \"allowed key pairs\" where you insert only one key pair per developer, and whenever you validate a signed rpm, you use that list as your trust base.\n\nshare|improve this answer\nadd comment\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}