bugManeage - Bugs: bug #58614, Verification/security issue...


You are not allowed to post comments on this tracker with your current authentication level.

bug #58614: Verification/security issue because sha512sum may not exist on host

Submitter:  Mohammad Akhlaghi <makhlaghi>
Submitted:  Thu 18 Jun 2020 07:27:57 PM UTC
Category:  Software Severity:  3 - Normal
Item Group:  Enhancement Status:  Postponed
Privacy:  Public Assigned to:  None
Open/Closed:  Open

Thu 18 Jun 2020 07:30:55 PM UTC, comment #1: 

Sorry! The "(at least on GNU/Linux systems)" was wrongly placed there!

Within Maneage, 'sha512sum' will be installed as part of GNU Coreutils on any host.

In the original version of the post (which was edited while forgetting to remove this parenthesis), I meant to say that on GNU/Linux systems, the host's 'sha512sum' will by default be part of GNU Coreutils.

Mohammad Akhlaghi <makhlaghi>
Group administrator
Thu 18 Jun 2020 07:27:57 PM UTC, original submission:  

While working on task #15686, I noticed a security/verification bootstrapping bug:

'sha512sum' is installed inside of Maneage as part of GNU Coreutils (at least on GNU/Linux systems). Before that, there is no guarantee that sha512sum actually exists on the host.

Hence, this is what we currently do: we check if 'sha512sum' exists in the PATH (which includes the host's PATH in 'basic.mk'). If it exists we use it to verify that the imported tarball is the correct one. Otherwise we don't check the tarball checksum and simply trust it! This will be the most likely problem.

A highly unlikely (yet possible!) scenario is if someone has a malicious intent. They can replace the 'sha512sum' in PATH with something that automatically extracts the checksum in the project and returns it, thus fooling the project to build what ever tarball they like.

One partial step would be to actually check the 'sha512sum' executable at configure time and print a huge warning if it isn't present or doesn't operate properly.

Maneage is primarily for scientific purposes and doesn't require root permissions. As discussed in Comment 1 of task 15696, the probability that a malicious intent would be present is low. But besides security, it does cause a problem with the validity checks of the tarballs (which is also being partly addressed by using Zenodo as the default server in task #15686).

But I just wanted to bring this up here so we find a good solution....

Mohammad Akhlaghi <makhlaghi>
Group administrator


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by makhlaghi (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


    No changes have been made to this item

    Back to the top

    Powered by Savane 3.12