Git-Mirrors/qubes-doc
1
0
Fork 0
mirror of https://github.com/QubesOS/qubes-doc.git synced 2025-09-19 12:34:41 -04:00
Code Issues Projects Releases Packages Wiki Activity

Rewrote SecurityPack in Markdown.

Browse source
This commit is contained in:
Axon 2015-06-05 03:19:01 +00:00
parent 32288f9eb9
commit 7b31877f17
No known key found for this signature in database
GPG key ID: 8CE137352A019A17
1 changed files with 119 additions and 120 deletions
Download patch file Download diff file Expand all files Collapse all files

67
SecurityPack.md
View file

@ -8,31 +8,26 @@ redirect_from: /wiki/SecurityPack/
Qubes Security Pack
===================
1. [Qubes Security Pack](#QubesSecurityPack)
1. [Introduction](#Introduction)
2. [History and Rationale](#HistoryandRationale)
3. [How to Obtain, Verify, and Read](#HowtoObtainVerifyandRead)
Introduction
------------
The **Qubes Security Pack (QSP)** is a Git repository which contains:
- [All Qubes Security Bulletins (QSBs)](/doc/SecurityBulletins/)
- [All PGP keys](https://keys.qubes-os.org/keys/)
- [Warrant canaries](https://en.wikipedia.org/wiki/Warrant_canary)
- Other security-related information and announcements (such as key revocations)
* [Qubes Security Bulletins (QSBs)](/doc/SecurityBulletins/)
* [Qubes PGP keys](https://keys.qubes-os.org/keys/)
* [Qubes warrant canaries](https://canarywatch.org/qubesOS/)
* Security-related information and announcements (e.g., key revocations)
The QSP is located here:
The official location of the QSP is:
`https://github.com/QubesOS/qubes-secpack`
[(link)](https://github.com/QubesOS/qubes-secpack)
> [https://github.com/QubesOS/qubes-secpack](https://github.com/QubesOS/qubes-secpack)
History and Rationale
---------------------
On 2013-01-05, Joanna Rutkowska announced the QSP and explained its rationale in an [email](https://groups.google.com/d/msg/qubes-devel/twkOEaMLtNI/lZyGx6_jFCEJ) to the Qubes mailing lists:
On 2013-01-05, Joanna Rutkowska announced the QSP and explained its rationale in
an [email](https://groups.google.com/d/msg/qubes-devel/twkOEaMLtNI/lZyGx6_jFCEJ)
to the Qubes mailing lists:
{% highlight trac-wiki %}
Hello,
A new Qubes Security Bulletin has been just released and is available here:
@ -118,16 +113,17 @@ Qubes binaries :/
[3] Deterministic builds are required because it's the only way we can
implement multiple signature scheme for distributed binaries.
{% endhighlight %}
How to Obtain, Verify, and Read
-------------------------------
The following example demonstrates one method of obtaining the QSP, verifying its contents, and reading them.
The following example demonstrates one method of obtaining the QSP, verifying
its contents, and reading them.
1. Clone the QSP repo.
{% highlight trac-wiki %}
```
[user@qubes ~]$ git clone https://github.com/QubesOS/qubes-secpack.git
Cloning into 'qubes-secpack'...
remote: Counting objects: 195, done.
@ -135,11 +131,11 @@ The following example demonstrates one method of obtaining the QSP, verifying it
Receiving objects: 100% (195/195), 130.94 KiB | 207.00 KiB/s, done.
Resolving deltas: 100% (47/47), done.
Checking connectivity... done.
{% endhighlight %}
```
2. Import the included PGP keys.
{% highlight trac-wiki %}
```
[user@qubes ~]$ gpg --import qubes-secpack/keys/*/*
gpg: directory `/home/user/.gnupg' created
gpg: new configuration file `/home/user/.gnupg/gpg.conf' created
@ -167,11 +163,11 @@ The following example demonstrates one method of obtaining the QSP, verifying it
gpg: Total number processed: 17
gpg: imported: 17 (RSA: 17)
gpg: no ultimately trusted keys found
{% endhighlight %}
```
3. Verify and trust the Qubes Master Signing Key.
{% highlight trac-wiki %}
```
[user@qubes ~]$ gpg --edit-key 36879494
gpg (GnuPG) 1.4.18; Copyright (C) 2014 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
@ -211,15 +207,20 @@ The following example demonstrates one method of obtaining the QSP, verifying it
unless you restart the program.
gpg> q
{% endhighlight %}
```
> **Important!**
**Important!**
> In order to verify the authenticity of the Qubes Master Signing Key prior to trusting it, you should obtain the Qubes Master Signing Key fingerprint from a trustworthy source (ideally, multiple sources) *other than* this website and visually compare it (them) to the fingerprint displayed in the preceding step, ensuring they match. You can read more about digital signatures and key verification [here](/doc/VerifyingSignatures/).
In order to verify the authenticity of the Qubes Master Signing Key prior to
trusting it, you should obtain the Qubes Master Signing Key fingerprint from
a trustworthy source (ideally, multiple sources) *other than* this website
and visually compare it (them) to the fingerprint displayed in the preceding
step, ensuring they match. You can read more about digital signatures and
key verification [here](/doc/VerifyingSignatures/).
1. Verify and read the canaries.
4. Verify and read the canaries.
{% highlight trac-wiki %}
```
[user@qubes ~]$ cd qubes-secpack/canaries/
[user@qubes canaries]$ gpg --verify canary-001-2015.txt.sig.joanna canary-001-2015.txt
gpg: Signature made Mon Jan 5 20:21:40 2015 UTC using RSA key ID 92C7B3DC
@ -233,11 +234,11 @@ The following example demonstrates one method of obtaining the QSP, verifying it
---===[ Qubes Canary #1 ]===---
[...]
{% endhighlight %}
```
2. Verify and read the QSBs.
5. Verify and read the QSBs.
{% highlight trac-wiki %}
```
[user@qubes canaries]$ cd ../QSBs/
[user@qubes QSBs]$ gpg --verify qsb-013-2015.txt.sig.joanna qsb-013-2015.txt
gpg: Signature made Mon Jan 5 21:22:14 2015 UTC using RSA key ID 92C7B3DC
@ -251,6 +252,4 @@ The following example demonstrates one method of obtaining the QSP, verifying it
---===[ Qubes Security Bulletin #13 ]===---
[...]
{% endhighlight %}
```