Simon Josefsson
Fediverse Profile link: https://fosstodon.org/@jas
github profile: https://gitlab.com/jas4711
gitlab profile: https://gitlab.com/jas
I like free software, protocols and standardization, computer security and other things.
Accepted Talks:
Apt Transparency
How to improve security of apt repositories with transparency techniques. I will describe attack threat models we should protect against that the current PGP-based trust apt ecosystem currently do not have any defense against. I propose we need a mechanism inspired by WebPKI’s Certificate Transparency, and that we consider existing technologies such as HTTPS canary files, Sigstore’s public transparency log, Sigsum’s public transparency log, and Filippo Valsorda’s spicy signatures. I will talk about interactions with reproducible builds to increase safety of package upgrades.
Storing *.debian.org in Git LFS
I will describe how (most of) *.debian.org is published via Git LFS repositories. Distributing big archives via Git LFS gives us some additional integrity, consistency, signature, transparency and other features. Since spring 2024 files have been collected into Git repositories that are replicated to GitLab and GitHub, covering ftp.debian.org, security.debian.org, archive.debian.org, ports.debian.org, and debug.mirrors.debian.org, and ongoing work is also adding snapshot.debian.org. We will talk about techniques to enable parallel imports to avoid single point of failure of the importer machine which caused outages for snapshot.debian.org collection in the past.
De-vendor orig.tar.gz: gnulib and more
I will discuss how to achieve de-vendor’ed orig.tar.gz upstream source code archives, with a focus on upstream’s that uses gnulib but also discuss general aspects. Avoiding vendoring gnulib and other files allows several advantages, including being able to security patch gnulib code in one package (the Debian gnulib package) and have that code trickle down to all packages using gnulib. Another advantage is reducing the amount of duplicated code that people have to audit to find concerns like the xz utils incident. I will cover progress in packaging since the idea was first introduced, and discuss some open issues still remaining.