So apparently npm has no package signing. I didn't realize it was that bad. The previous developer didn't even need to hand over a signing key to the new developer, since nothing is being signed and verified anyway. What if they had simply chosen a bad / reused password for npm?
Conversation
hard to imagine how package signing works without key management, and key management doesn’t work at scale, so i’m not sure this is a super fair criticism
1
1
2
I think TUF works well for managing a developer PKI and applying package AuthZ policies, however it’s also worth noting that would’ve done nothing to prevent this particular attack, since it was malware injected via transitive dependencies by an authorized publisher
1
There are language package managers with package signing. At the very least, pinning the key fingerprint on first use with a mechanism for automatically rotating to requiring signatures from additional new keys works well.
2
1
I'm not sure that end-user key management actually does work well for a system that operates at the scale that NPM does. Do you know what the largest deployment of such a package manager is?
2
I don't understand what scale has to do with it. Package signing works fine for many other package managers with a large scale. The basic trust on first use security properties don't require any end user key management or extra work on their part.
1
If you’re talking about things like Linux distros, those systems generally have automated signing by central build servers, or at the very least have no form of open enrollment.
1
I spent years working on Arch Linux and that's not how it worked at all. The package sources have pinned PGP key fingerprints which are used to automatically verify the sources. There are also pinned hashes for each version. Change of key is investigated.
git.archlinux.org/svntogit/packa
1
Developers build and sign the binary packages with their own keys. They're responsible for the security of their packages. The package manager trusts packages signed by a packager with at least 3/5 signatures from the master keys on their personal package signing key.
2
1
That sounds awful. I prefer my Linux distros securely compiled and signed by a central build system. All of this is orthogonal to language package managers.
1
It's not orthogonal to language package managers, and I don't think that trusting a server build server as a single central point of failure without individual accountability is better. An improvement is having reproducible builds and requiring multiple signatures.
The approach taking by other distributions is trusting both developers and a central build server, since the developers are fully trusted with setting up what the server is going to build and sign with an online key. Still way better than not having the package signing at all.