FOSS Activities in April 2021
Yo!
Hope people have had a lovely spring. This month has passed quickly! I have put off writing the monthly post because I was busy with a weekend project.
My master thesis was about how to apply transparency logs and reproducible builds to give package rebuilders the ability to produce tamper evident logs. This is handy since any one package build can easily be proven to be part of the log, and you can very easily fill inn the history from one point in time to another by hashing files in the correct order.
These days transparency logs has seen a larger adoption with projects like sigstore and trustix. What’s interesting is that kernel.org publishes a transparency log of all the git push operations.
This is handy as it allows people to verify that a commit was actually pushed from a kernel developer. This prevents cases where someone with access to kernel.org can’t create a commit on the server without it being possible to detect. However, transparency logs are only really useful if people monitor them for changes and replicate them. Thus i decided to quickly hack up a monitor on the log to make the information easily digestible.
I’ll probably continue to hack on this project a little bit to get some statistics between kernel releases. Maybe some graphs? But currently it works quite nicely to display the information on the log. A fun little project!
While talking about kernel security, the Linux TAB published their report on the entire University of Minnesota fiasco. Whats interesting about the email is that they linked the IEEE complaint Santiago, me and a few others wrote after reading the abstract back in December. I have no clue how they got the link since the draft pad was never shared outside of the twitter group we had. Weird 😀
https://lwn.net/ml/linux-kernel/202105051005.49BFABCE@keescook/
Other then that I have submitted a patch to Golang to default add full relro
flags when building with PIE and using the host compiler. I also did my first
patch to a kernel related mailing list to patch a bug in b4.
Rest of the work has mostly been to get my secure boot tooling up to speed so I
can move off from the preexisting Canonical tooling and better test. This has
resulted in go-uefi, my Golang native library for interactive with efivarfs
on Linux, having some form of integration tests towards OVMF. Which is great 😃
https://github.com/Foxboron/go-uefi/tree/master/tests
Lastly the work on debug packages in Arch has slowed down due to lack of feedback on the patches. I wanted to have the stuff out in February but sadly it’s going to take longer. Disappointing but stuff happens.
Cheers and see you next month!
go updated to 2:1.16.3-1salt updated to 3003-1, 3003-2plocate updated to 1.1.6-1, 1.1.7-1crun updated to 0.19-1, 0.19.1-1github-cli updated to 1.8.1-1, 1.9.1-1, 1.9.2-1k9s updated to 0.24.7-1qutebrowser updated to 2.1.1-1, 2.2.0-1, 2.2.1-1python-nbxmpp updated to 2.0.2-1python-nvxmpp updated to 2.0.2-1fzf updated to 0.27.0-1archlinux-repro updated to 20210408-1, 20210422-1docker-compose updated to 1.29.0-1, 1.29.1-2python-dotenv updated to 0.17.0-1python-docker updated to 5.0.0-1pdfjs updated to 2.8.335-1yubico-pam updated to 2.27-1python-nltk updated to 3.6.1-1buildah updated to 1.20.0-2, 1.20.1-1python-docs updated to 3.9.4-1lxd updated to 4.13-1python-adblock updated to 0.4.4-1sbctl updated to 0.2-1, 0.3-1lostfiles updated to 4.11-1step-ca updated to 0.15.14-1skopeo updated to 1.2.3-1podman updated to 3.1.1-1, 3.1.1-2, 3.1.2-1archlinux-contrib updated to 20210418-1poke updated to 1.2-1helm updated to 3.5.4-1nvme-cli updated to 1.14-1python-m2crypto updated to 0.37.1-2python-psycopg2 updated to 2.8.6-4b4 updated to 0.6.2-2borg updated to 1.1.16-3mopidy updated to 3.1.1-3raft updated to 0.10.1-1dqlite updated to 1.7.0-1dunst updated to 1.6.1-1, 1.6.1-2lxcfs updated to 4.0.8-1lxc updated to 1:4.0.8-1python2-m2cryptopython2-traitletspython2-prompt_toolkit1python2-geventpython2-pathlibpython2-tarantoolpython2-psycopg2oomdvgrepgit-publishpsi-notifyetcdgoseckindnomaddistrobuilderhunspell-nbhunspell-nnmagic-wormhole-buildmode=pie: https://github.com/golang/go/pull/45681此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。