Bug 1599915

Summary:	RFE: cert pinning
Product:	[Fedora] Fedora	Reporter:	Kevin Fenzi <kevin>
Component:	librepo	Assignee:	rpm-software-management
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	mblaha, tmlcoch
Target Milestone:	---	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Kevin Fenzi 2018-07-10 22:45:06 UTC

In https://pagure.io/fedora-infrastructure/issue/5372 we talk about cert pinning for atomic host content. 

Is this something that might be possible to implement here as well? 

basically we would hard code into the package information about all the cert(s) that fedoraproject.org would use so it could validate that there was no MITM or other issues happening.

Comment 1 Jaroslav Mracek 2023-08-23 06:35:05 UTC

For which purpose you would like to use these certificates? I am asking because I am not sure whether such an approach is optimal for dnf because availability of certificates after rpm install means that they are not available during the transaction for any verification.

Comment 2 Kevin Fenzi 2023-08-28 17:24:44 UTC

Yeah, I realize this is kind of a vuage request. Sorry about that. 

I think the idea was that we could hard code/ship in dnf itself the cert (or a fingerprint, etc) of the mirrors.fedoraproject.org cert.
Then, it could check this internal thing to make sure it was talking to the real mirrors.fedoraproject.org.

However, this presents various hard problems like updating the cert when we do, setups with proxies where they trust their proxy and it has a differnt cert, etc.

I'm fine to just close this for now unless a advocate for it is willing to design something here.