Jon Pretty

I’ve been spending time recently thinking about PGP signatures and SBT. Specifically, thinking about trust models, threat models, and how to realistically (read: both in meaning and in terms of user adoption) verify build artifacts. My conclusion thus far: everything is awful.

Here’s the root of the problem… Artifact signing is supposed to be a tool to make sure the artifact was published by who you think it was. It is designed to be verified by whoever downloaded the artifact (so, SBT). Ignore the “key claiming/trust” problem. How do we trust SBT?

A major attack vector removed by signature checks is MITM on artifact acquisition. SBT *itself* and all of its plugins are obtained as artifacts! So… how can we trust SBT’s own verification?

Our trust in our random artifacts is effectively the same as our trust in SBT. So we need an external verifier, like a signed secure launcher. But everyone launches SBT using random scripts they curled off the inter webs.

Probably the only way to resolve this is to get Travis (and other CIs) into the fray. They need to do signature checks on build tool launchers, checked against key lists they control and curate. Then bootstrap from there.

If we can get a trusted SBT script, it can embed keys to verify SBT and a global verification plugin, which can verify everything else in the build. Still doesn’t even touch the artifact verification and key claiming problem, but at least the ground is no longer quicksand.

As it stands (the ecosystem), there’s almost no point in working on artifact signature checks, since all of the same threats that could compromise artifacts would *also* compromise SBT itself and, by extension, the signature verification.