[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #31988 [Applications/Tor Browser]: Generate a mar signing key for nightly builds
#31988: Generate a mar signing key for nightly builds
-------------------------------------------------+-------------------------
Reporter: boklm | Owner: boklm
Type: defect | Status:
| needs_review
Priority: Medium | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: tbb-rbm, boklm201910, tbb-update, | Actual Points: 1
TorBrowserTeam202001R |
Parent ID: #18867 | Points: 1
Reviewer: mcs | Sponsor:
-------------------------------------------------+-------------------------
Comment (by boklm):
Replying to [comment:9 mcs]:
> The script looks good. Do we expect to use this script manually or via
automation? If we only plan to use it manually, it seems like we should
avoid using `--empty-password`. Of course if we do not use that option
then there will be another password for us to track.
I have been thinking about adding a password to the key, but then realized
that we will using this key to sign automatically new nightly builds, so
the signing script will need to know the password and we would need to
store the password in a file along with the key. This means that if an
attacker is able to steal the key, they will also likely be able to steal
the password with it. So it seems to me that having a password does not
provide any additional protection, and not having one make things a little
more simple.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/31988#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs