{"action":"created","issue":{"url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/543","labels_url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/543/labels{/name}","comments_url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/543/comments","events_url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/543/events","html_url":"https://github.com/sparkle-project/Sparkle/issues/543","id":76172633,"number":543,"title":"Make DSA Signatures Mandatory","user":{"login":"zorgiepoo","id":857267,"avatar_url":"https://avatars.githubusercontent.com/u/857267?v=3","gravatar_id":"","url":"https://api.github.com/users/zorgiepoo","html_url":"https://github.com/zorgiepoo","followers_url":"https://api.github.com/users/zorgiepoo/followers","following_url":"https://api.github.com/users/zorgiepoo/following{/other_user}","gists_url":"https://api.github.com/users/zorgiepoo/gists{/gist_id}","starred_url":"https://api.github.com/users/zorgiepoo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zorgiepoo/subscriptions","organizations_url":"https://api.github.com/users/zorgiepoo/orgs","repos_url":"https://api.github.com/users/zorgiepoo/repos","events_url":"https://api.github.com/users/zorgiepoo/events{/privacy}","received_events_url":"https://api.github.com/users/zorgiepoo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-14T00:17:16Z","updated_at":"2015-05-16T17:08:41Z","closed_at":null,"body":"I strongly believe that DSA signatures should be required.\r\n\r\nFrom my observations:\r\n\r\n**Code Signing** ensures the *System* can verify that the content inside the application came from the developer.\r\n\r\n**DSA Signatures** ensures *Sparkle* can verify that the archive is downloaded exactly as the developer created it.\r\n\r\nTo show how these are different, one needs to realize that code signing *intentionally* allows changes to the app that doesn't break the application's signature.\r\n\r\nSpecifically, removing localization files, removing architectures from a mach-o binary, and allowing code inside the application to be replaced with other code signed by the same developer. The last point (which I quickly tested myself) implies someone could take an old executable and insert/replace it into a new application's update.\r\n\r\nIn the past, code signing also allowed resource rules to exclude certain files from being checked. Code signing also presently allows file permission changes (rdar://20835014).\r\n\r\nCurrently, validation code ignores DSA signatures if applications are signed (see issue #534). Sparkle also *does not* perform a deep code signature validation of an application, which makes Sparkle not being able to detect plenty of bad changes (see issue #523).\r\n\r\nFurther, even if we could perform a deep check of an app's signature, we may not want to because of how CPU intensive/time consuming it can be for large applications. Ironically, I believe that unsigned applications that use Sparkle are the ones that have a more secure updating process.\r\n\r\nNot requiring a DSA signature, or at least a public key in the app, is also inconsistent with how Sparkle deals with other mechanisms (packages, system prefpanes, whatever else), and it's also a burden if anyone wants to transition to delta updates which we should encourage more use towards in the some-time future.\r\n\r\nIt is true requiring a DSA signature is slightly more inconvenient when making an update. But if it's a whole lot more inconvenient, this just means the developer hasn't automated their update creation process. And this could even be thought of as a favor for making them do that..\r\n\r\nLastly, this is not to say basic code signing validation is completely useless, since it may catch cases where the application isn't archived or unarchived properly that may go otherwise unnoticed. But thinking of DSA signatures as the \"old\" or not recommended way as this wiki suggests seems to be quite dangerous (and in many cases inefficient) to me.\r\n\r\nThoughts?"},"comment":{"url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/comments/102655484","html_url":"https://github.com/sparkle-project/Sparkle/issues/543#issuecomment-102655484","issue_url":"https://api.github.com/repos/sparkle-project/Sparkle/issues/543","id":102655484,"user":{"login":"zorgiepoo","id":857267,"avatar_url":"https://avatars.githubusercontent.com/u/857267?v=3","gravatar_id":"","url":"https://api.github.com/users/zorgiepoo","html_url":"https://github.com/zorgiepoo","followers_url":"https://api.github.com/users/zorgiepoo/followers","following_url":"https://api.github.com/users/zorgiepoo/following{/other_user}","gists_url":"https://api.github.com/users/zorgiepoo/gists{/gist_id}","starred_url":"https://api.github.com/users/zorgiepoo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zorgiepoo/subscriptions","organizations_url":"https://api.github.com/users/zorgiepoo/orgs","repos_url":"https://api.github.com/users/zorgiepoo/repos","events_url":"https://api.github.com/users/zorgiepoo/events{/privacy}","received_events_url":"https://api.github.com/users/zorgiepoo/received_events","type":"User","site_admin":false},"created_at":"2015-05-16T17:08:41Z","updated_at":"2015-05-16T17:08:41Z","body":"Alternatively, serving over https might work as well as an alternative over Sparkle's DSA signatures. That might even be a little more secure since it would also prevent an attacker inserting newer updates from a beta appcast into a stable one for example. I have the feeling Sparkle handled https at one point but doesn't do that anymore."}}