ARarmitron·Sep 29, 2017
This still doesn't solve the problem of upstream security,
since it requires clients trust the Quicklisp repository
which is centralized rather than the individual package authors. The chain of trust is now bigger and more fragile.
Quicklisp works by periodically pulling packages from their official (or unofficial) repos into a centralized repository controlled by Xach. Xach then creates a Quicklisp "release" based on the set of pulled packages.
Quicklisp users end up pulling from Xach's repository rather than upstream directly.
This PGP verification update only applies to the second path: Quicklisp user to Xach's centralized repository.
In terms of actual security of Quicklisp, the situation is still not at all good, since Xach is using unsafe methods to pull code from upstream into his centralized repository:
$ git clone https://githu
Read the rest
b.com/quicklisp/quicklisp-projects
Cloning into 'quicklisp-projects'...
remote: Counting objects: 9495, done.
remote: Total 9495 (delta 0), reused 0 (delta 0), pack reused 9495
Receiving objects: 100% (9495/9495), 1.70 MiB | 1.22 MiB/s, done.
Resolving deltas: 100% (1653/1653), done.
$ egrep -R 'git://|http://' quicklisp-projects/ |wc -l
125
There are ~125 projects in Quicklisp that are fetched over unencrypted and trivially man-in-the-middled protocols. Moreover, the centralized Quicklisp architecture is also vulnerable to hacking since it provides a single point of failure.
Suggestions that will provide actual security:
+ Scrap the centralized package distribution model.
+ Quicklisp acts as a metadata/added-value repository and keeps providing releases but the Quicklisp client ends up hitting upstream and not a central repository controlled by a middle man.
+ If upstream sources are insecure (git/http), flag and warn on install by default.
We had a lot of these (the important bits) with asdf-install. Unfortunately, when people started adopting Quicklisp because of the unimportant bits (convenience)
they threw the baby out with the bathwater and ended up compromising on the things that truly matter.
It's not too late to recognize this and pull back from something that will never be secure. My suggestions add up to adding the convenience layer to a model that's basically asdf-install that can pull software from multiple sources.