[Whonix-devel] qubes-linux-template-builder Debian apt-get --force-yes --yes security issue?

Tue Apr 28 02:52:48 CEST 2015

On Monday, 27 April 2015 18:34:12 UTC-4, Jason M wrote:
>
> On 27 April 2015 at 18:26, Patrick Schleizer wrote:
>
>> Hi!
>>
>> From
>> qubes-linux-template-builder/scripts_debian/vars.sh
>>
>> https://github.com/QubesOS/qubes-builder-debian/blob/33109b3ed425fc5c590b5e551ed4739373076609/template_qubuntu/vars.sh#L25
>>
>> APT_GET_OPTIONS="-o Dpkg::Options::="--force-confnew" --force-yes --yes"
>>
>> Could be a security issue. The combination of --force-yes and --yes is
>> insecure. Could lead to installation of unsigned packages.
>>
>> Concluded that by reading the source and by remembering a bug report
>> against a similar Debian image build script where I did some testing.
>>
>> - https://github.com/grml/grml-debootstrap/issues/62
>> -
>>
>> https://www.whonix.org/wiki/Dev/apt-get#apt-get_Install_Signed_vs_Unsigned_Packages
>>
>> I didn't actually test here but I find this quite possible. Highly
>> recommend to drop the --force-yes.
>>
>
> Good catch.  I will investigate it further.  The purpose is the 
> `--force-yes` is to all the over riding package configuration when 
> initially building the template.  Will see what happens without the force 
> option.
>

I removed the --force-yes option and everything seems to build fine still.  
I will submit a PR most likely tonight after some more testing has been 
completed. 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.whonix.org/pipermail/whonix-devel/attachments/20150427/e2adbdb6/attachment.html>