mirror of
https://github.com/QubesOS/qubes-doc.git
synced 2025-09-20 04:54:38 -04:00
Rewrote SecurityPack in Markdown.
This commit is contained in:
parent
32288f9eb9
commit
7b31877f17
1 changed files with 119 additions and 120 deletions
|
@ -8,31 +8,26 @@ redirect_from: /wiki/SecurityPack/
|
||||||
Qubes Security Pack
|
Qubes Security Pack
|
||||||
===================
|
===================
|
||||||
|
|
||||||
1. [Qubes Security Pack](#QubesSecurityPack)
|
|
||||||
1. [Introduction](#Introduction)
|
|
||||||
2. [History and Rationale](#HistoryandRationale)
|
|
||||||
3. [How to Obtain, Verify, and Read](#HowtoObtainVerifyandRead)
|
|
||||||
|
|
||||||
Introduction
|
|
||||||
------------
|
|
||||||
|
|
||||||
The **Qubes Security Pack (QSP)** is a Git repository which contains:
|
The **Qubes Security Pack (QSP)** is a Git repository which contains:
|
||||||
|
|
||||||
- [All Qubes Security Bulletins (QSBs)](/doc/SecurityBulletins/)
|
* [Qubes Security Bulletins (QSBs)](/doc/SecurityBulletins/)
|
||||||
- [All PGP keys](https://keys.qubes-os.org/keys/)
|
* [Qubes PGP keys](https://keys.qubes-os.org/keys/)
|
||||||
- [Warrant canaries](https://en.wikipedia.org/wiki/Warrant_canary)
|
* [Qubes warrant canaries](https://canarywatch.org/qubesOS/)
|
||||||
- Other security-related information and announcements (such as key revocations)
|
* Security-related information and announcements (e.g., key revocations)
|
||||||
|
|
||||||
The QSP is located here:
|
The official location of the QSP is:
|
||||||
|
|
||||||
|
`https://github.com/QubesOS/qubes-secpack`
|
||||||
|
[(link)](https://github.com/QubesOS/qubes-secpack)
|
||||||
|
|
||||||
> [https://github.com/QubesOS/qubes-secpack](https://github.com/QubesOS/qubes-secpack)
|
|
||||||
|
|
||||||
History and Rationale
|
History and Rationale
|
||||||
---------------------
|
---------------------
|
||||||
|
|
||||||
On 2013-01-05, Joanna Rutkowska announced the QSP and explained its rationale in an [email](https://groups.google.com/d/msg/qubes-devel/twkOEaMLtNI/lZyGx6_jFCEJ) to the Qubes mailing lists:
|
On 2013-01-05, Joanna Rutkowska announced the QSP and explained its rationale in
|
||||||
|
an [email](https://groups.google.com/d/msg/qubes-devel/twkOEaMLtNI/lZyGx6_jFCEJ)
|
||||||
|
to the Qubes mailing lists:
|
||||||
|
|
||||||
{% highlight trac-wiki %}
|
|
||||||
Hello,
|
Hello,
|
||||||
|
|
||||||
A new Qubes Security Bulletin has been just released and is available here:
|
A new Qubes Security Bulletin has been just released and is available here:
|
||||||
|
@ -118,16 +113,17 @@ Qubes binaries :/
|
||||||
|
|
||||||
[3] Deterministic builds are required because it's the only way we can
|
[3] Deterministic builds are required because it's the only way we can
|
||||||
implement multiple signature scheme for distributed binaries.
|
implement multiple signature scheme for distributed binaries.
|
||||||
{% endhighlight %}
|
|
||||||
|
|
||||||
How to Obtain, Verify, and Read
|
How to Obtain, Verify, and Read
|
||||||
-------------------------------
|
-------------------------------
|
||||||
|
|
||||||
The following example demonstrates one method of obtaining the QSP, verifying its contents, and reading them.
|
The following example demonstrates one method of obtaining the QSP, verifying
|
||||||
|
its contents, and reading them.
|
||||||
|
|
||||||
1. Clone the QSP repo.
|
1. Clone the QSP repo.
|
||||||
|
|
||||||
{% highlight trac-wiki %}
|
```
|
||||||
[user@qubes ~]$ git clone https://github.com/QubesOS/qubes-secpack.git
|
[user@qubes ~]$ git clone https://github.com/QubesOS/qubes-secpack.git
|
||||||
Cloning into 'qubes-secpack'...
|
Cloning into 'qubes-secpack'...
|
||||||
remote: Counting objects: 195, done.
|
remote: Counting objects: 195, done.
|
||||||
|
@ -135,11 +131,11 @@ The following example demonstrates one method of obtaining the QSP, verifying it
|
||||||
Receiving objects: 100% (195/195), 130.94 KiB | 207.00 KiB/s, done.
|
Receiving objects: 100% (195/195), 130.94 KiB | 207.00 KiB/s, done.
|
||||||
Resolving deltas: 100% (47/47), done.
|
Resolving deltas: 100% (47/47), done.
|
||||||
Checking connectivity... done.
|
Checking connectivity... done.
|
||||||
{% endhighlight %}
|
```
|
||||||
|
|
||||||
2. Import the included PGP keys.
|
2. Import the included PGP keys.
|
||||||
|
|
||||||
{% highlight trac-wiki %}
|
```
|
||||||
[user@qubes ~]$ gpg --import qubes-secpack/keys/*/*
|
[user@qubes ~]$ gpg --import qubes-secpack/keys/*/*
|
||||||
gpg: directory `/home/user/.gnupg' created
|
gpg: directory `/home/user/.gnupg' created
|
||||||
gpg: new configuration file `/home/user/.gnupg/gpg.conf' created
|
gpg: new configuration file `/home/user/.gnupg/gpg.conf' created
|
||||||
|
@ -167,11 +163,11 @@ The following example demonstrates one method of obtaining the QSP, verifying it
|
||||||
gpg: Total number processed: 17
|
gpg: Total number processed: 17
|
||||||
gpg: imported: 17 (RSA: 17)
|
gpg: imported: 17 (RSA: 17)
|
||||||
gpg: no ultimately trusted keys found
|
gpg: no ultimately trusted keys found
|
||||||
{% endhighlight %}
|
```
|
||||||
|
|
||||||
3. Verify and trust the Qubes Master Signing Key.
|
3. Verify and trust the Qubes Master Signing Key.
|
||||||
|
|
||||||
{% highlight trac-wiki %}
|
```
|
||||||
[user@qubes ~]$ gpg --edit-key 36879494
|
[user@qubes ~]$ gpg --edit-key 36879494
|
||||||
gpg (GnuPG) 1.4.18; Copyright (C) 2014 Free Software Foundation, Inc.
|
gpg (GnuPG) 1.4.18; Copyright (C) 2014 Free Software Foundation, Inc.
|
||||||
This is free software: you are free to change and redistribute it.
|
This is free software: you are free to change and redistribute it.
|
||||||
|
@ -211,15 +207,20 @@ The following example demonstrates one method of obtaining the QSP, verifying it
|
||||||
unless you restart the program.
|
unless you restart the program.
|
||||||
|
|
||||||
gpg> q
|
gpg> q
|
||||||
{% endhighlight %}
|
```
|
||||||
|
|
||||||
> **Important!**
|
**Important!**
|
||||||
|
|
||||||
> In order to verify the authenticity of the Qubes Master Signing Key prior to trusting it, you should obtain the Qubes Master Signing Key fingerprint from a trustworthy source (ideally, multiple sources) *other than* this website and visually compare it (them) to the fingerprint displayed in the preceding step, ensuring they match. You can read more about digital signatures and key verification [here](/doc/VerifyingSignatures/).
|
In order to verify the authenticity of the Qubes Master Signing Key prior to
|
||||||
|
trusting it, you should obtain the Qubes Master Signing Key fingerprint from
|
||||||
|
a trustworthy source (ideally, multiple sources) *other than* this website
|
||||||
|
and visually compare it (them) to the fingerprint displayed in the preceding
|
||||||
|
step, ensuring they match. You can read more about digital signatures and
|
||||||
|
key verification [here](/doc/VerifyingSignatures/).
|
||||||
|
|
||||||
1. Verify and read the canaries.
|
4. Verify and read the canaries.
|
||||||
|
|
||||||
{% highlight trac-wiki %}
|
```
|
||||||
[user@qubes ~]$ cd qubes-secpack/canaries/
|
[user@qubes ~]$ cd qubes-secpack/canaries/
|
||||||
[user@qubes canaries]$ gpg --verify canary-001-2015.txt.sig.joanna canary-001-2015.txt
|
[user@qubes canaries]$ gpg --verify canary-001-2015.txt.sig.joanna canary-001-2015.txt
|
||||||
gpg: Signature made Mon Jan 5 20:21:40 2015 UTC using RSA key ID 92C7B3DC
|
gpg: Signature made Mon Jan 5 20:21:40 2015 UTC using RSA key ID 92C7B3DC
|
||||||
|
@ -233,11 +234,11 @@ The following example demonstrates one method of obtaining the QSP, verifying it
|
||||||
---===[ Qubes Canary #1 ]===---
|
---===[ Qubes Canary #1 ]===---
|
||||||
|
|
||||||
[...]
|
[...]
|
||||||
{% endhighlight %}
|
```
|
||||||
|
|
||||||
2. Verify and read the QSBs.
|
5. Verify and read the QSBs.
|
||||||
|
|
||||||
{% highlight trac-wiki %}
|
```
|
||||||
[user@qubes canaries]$ cd ../QSBs/
|
[user@qubes canaries]$ cd ../QSBs/
|
||||||
[user@qubes QSBs]$ gpg --verify qsb-013-2015.txt.sig.joanna qsb-013-2015.txt
|
[user@qubes QSBs]$ gpg --verify qsb-013-2015.txt.sig.joanna qsb-013-2015.txt
|
||||||
gpg: Signature made Mon Jan 5 21:22:14 2015 UTC using RSA key ID 92C7B3DC
|
gpg: Signature made Mon Jan 5 21:22:14 2015 UTC using RSA key ID 92C7B3DC
|
||||||
|
@ -251,6 +252,4 @@ The following example demonstrates one method of obtaining the QSP, verifying it
|
||||||
---===[ Qubes Security Bulletin #13 ]===---
|
---===[ Qubes Security Bulletin #13 ]===---
|
||||||
|
|
||||||
[...]
|
[...]
|
||||||
{% endhighlight %}
|
```
|
||||||
|
|
||||||
|
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue