{"action":"created","issue":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/1020","labels_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/1020/labels{/name}","comments_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/1020/comments","events_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/1020/events","html_url":"https://github.com/QubesOS/qubes-issues/issues/1020","id":84585455,"number":1020,"title":"qubes-builder-debian - replace local key creation with trusted=yes","user":{"login":"adrelanos","id":1985040,"avatar_url":"https://avatars.githubusercontent.com/u/1985040?v=3","gravatar_id":"","url":"https://api.github.com/users/adrelanos","html_url":"https://github.com/adrelanos","followers_url":"https://api.github.com/users/adrelanos/followers","following_url":"https://api.github.com/users/adrelanos/following{/other_user}","gists_url":"https://api.github.com/users/adrelanos/gists{/gist_id}","starred_url":"https://api.github.com/users/adrelanos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adrelanos/subscriptions","organizations_url":"https://api.github.com/users/adrelanos/orgs","repos_url":"https://api.github.com/users/adrelanos/repos","events_url":"https://api.github.com/users/adrelanos/events{/privacy}","received_events_url":"https://api.github.com/users/adrelanos/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-06-03T14:11:06Z","updated_at":"2015-06-03T14:40:11Z","closed_at":null,"body":"About\r\n\r\n* https://github.com/QubesOS/qubes-builder-debian/blob/cf29fccd63c1e8e00819db09d8eb1c280a61ade3/prepare-chroot-debian#L135-143\r\n* https://github.com/QubesOS/qubes-builder-debian/blob/master/prepare-chroot-qubuntu#L118-126\r\n\r\n```\r\nKey-Type: RSA\r\nKey-Length: 1024\r\n```\r\n\r\nThis is a weak key. Even if it's just a local key and perfectly secure... It's a source for FUD. Fear, uncertainty, doubt. And from a marketing perspective, FUD can kill a project. I don't want to distract discussion of real security issues with such easy-to-confuse-easy-to-fix false-positives.\r\n\r\nCan you please use deb `[trusted=yes]` rather than local signing key for local apt repository? I.e.\r\n\r\n```\r\ndeb file:/tmp/qubes-deb $DEBIANVERSION main\r\n```\r\n\r\n-->\r\n\r\n```\r\ndeb [trusted=yes] file:/tmp/qubes-deb $DEBIANVERSION main\r\n```\r\n\r\nand removing the local key creation should do. Also less code and more elegant.\r\n\r\n(Similar to https://phabricator.whonix.org/T275#3897.) (@nrgaway)\r\n"},"comment":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/comments/108461382","html_url":"https://github.com/QubesOS/qubes-issues/issues/1020#issuecomment-108461382","issue_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/1020","id":108461382,"user":{"login":"nrgaway","id":441906,"avatar_url":"https://avatars.githubusercontent.com/u/441906?v=3","gravatar_id":"","url":"https://api.github.com/users/nrgaway","html_url":"https://github.com/nrgaway","followers_url":"https://api.github.com/users/nrgaway/followers","following_url":"https://api.github.com/users/nrgaway/following{/other_user}","gists_url":"https://api.github.com/users/nrgaway/gists{/gist_id}","starred_url":"https://api.github.com/users/nrgaway/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nrgaway/subscriptions","organizations_url":"https://api.github.com/users/nrgaway/orgs","repos_url":"https://api.github.com/users/nrgaway/repos","events_url":"https://api.github.com/users/nrgaway/events{/privacy}","received_events_url":"https://api.github.com/users/nrgaway/received_events","type":"User","site_admin":false},"created_at":"2015-06-03T14:40:11Z","updated_at":"2015-06-03T14:40:11Z","body":"On 3 June 2015 at 10:11, Patrick Schleizer <notifications@github.com> wrote:\n\n> About\n>\n>    -\n>    https://github.com/QubesOS/qubes-builder-debian/blob/cf29fccd63c1e8e00819db09d8eb1c280a61ade3/prepare-chroot-debian#L135-143\n>    -\n>    https://github.com/QubesOS/qubes-builder-debian/blob/master/prepare-chroot-qubuntu#L118-126\n>\n> Key-Type: RSA\n> Key-Length: 1024\n>\n> This is a weak key. Even if it's just a local key and perfectly secure...\n> It's a source for FUD. Fear, uncertainty, doubt. And from a marketing\n> perspective, FUD can kill a project. I don't want to distract discussion of\n> real security issues with such easy-to-confuse-easy-to-fix false-positives.\n>\n> Can you please use deb [trusted=yes] rather than local signing key for\n> local apt repository? I.e.\n>\n> deb file:/tmp/qubes-deb $DEBIANVERSION main\n>\n> -->\n>\n> deb [trusted=yes] file:/tmp/qubes-deb $DEBIANVERSION main\n>\n> and removing the local key creation should do. Also less code and more\n> elegant.\n>\n> (Similar to https://phabricator.whonix.org/T275#3897.) (@nrgaway\n> <https://github.com/nrgaway>)\n>\nI personally do not see how this can create FUD since as you noted the keys\nare created for local installation of packages during initial template\ncreation and not for distribution purposes.  Wouldn't having no key at all\nprovide the same concerns?\n\nAnyway, if @marmarek feels this should be changed could we not just\nincrease the key size to minimize code changes?\n"}}