{"action":"created","issue":{"url":"https://api.github.com/repos/pypa/manylinux/issues/46","repository_url":"https://api.github.com/repos/pypa/manylinux","labels_url":"https://api.github.com/repos/pypa/manylinux/issues/46/labels{/name}","comments_url":"https://api.github.com/repos/pypa/manylinux/issues/46/comments","events_url":"https://api.github.com/repos/pypa/manylinux/issues/46/events","html_url":"https://github.com/pypa/manylinux/issues/46","id":145498148,"number":46,"title":"Security hardening for the manylinux1 docker creation/distribution process","user":{"login":"ogrisel","id":89061,"avatar_url":"https://avatars.githubusercontent.com/u/89061?v=3","gravatar_id":"","url":"https://api.github.com/users/ogrisel","html_url":"https://github.com/ogrisel","followers_url":"https://api.github.com/users/ogrisel/followers","following_url":"https://api.github.com/users/ogrisel/following{/other_user}","gists_url":"https://api.github.com/users/ogrisel/gists{/gist_id}","starred_url":"https://api.github.com/users/ogrisel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ogrisel/subscriptions","organizations_url":"https://api.github.com/users/ogrisel/orgs","repos_url":"https://api.github.com/users/ogrisel/repos","events_url":"https://api.github.com/users/ogrisel/events{/privacy}","received_events_url":"https://api.github.com/users/ogrisel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":15,"created_at":"2016-04-03T13:10:35Z","updated_at":"2016-04-08T20:59:15Z","closed_at":null,"body":"I am opening this issue to keep track of the open questions raised in the discussion at https://github.com/pypa/manylinux/pull/44#discussion_r58304678.\r\n\r\nAn attacker might find ways to silently install a rootkit in the binaries (especially the gcc and patchelf commands) of our quay.io hosted docker images. The attack could happen on quay.io, on github.com, on the travis build machine or on one of the third party resources we fetch software from in our build scripts (centos repositories, patchelf source repository and others). At the moment we have no easy way to detect such attacks.\r\n\r\nOne way we could at least detect that something is wrong would be to compute the sha256sum of all the binaries of our docker images and store that list of hashes offline and maybe a also hash the hash list could be pushed to an independent append-only time-stamped public log (for instance a dedicated twitter account).\r\n\r\nWe should also probably setup some automated CI bot to periodically recompute the sha256sum list of all the files in the public quay.io hosted images and compare them to the matching entry of the append-only time-stamped public log."},"comment":{"url":"https://api.github.com/repos/pypa/manylinux/issues/comments/207604593","html_url":"https://github.com/pypa/manylinux/issues/46#issuecomment-207604593","issue_url":"https://api.github.com/repos/pypa/manylinux/issues/46","id":207604593,"user":{"login":"ogrisel","id":89061,"avatar_url":"https://avatars.githubusercontent.com/u/89061?v=3","gravatar_id":"","url":"https://api.github.com/users/ogrisel","html_url":"https://github.com/ogrisel","followers_url":"https://api.github.com/users/ogrisel/followers","following_url":"https://api.github.com/users/ogrisel/following{/other_user}","gists_url":"https://api.github.com/users/ogrisel/gists{/gist_id}","starred_url":"https://api.github.com/users/ogrisel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ogrisel/subscriptions","organizations_url":"https://api.github.com/users/ogrisel/orgs","repos_url":"https://api.github.com/users/ogrisel/repos","events_url":"https://api.github.com/users/ogrisel/events{/privacy}","received_events_url":"https://api.github.com/users/ogrisel/received_events","type":"User","site_admin":false},"created_at":"2016-04-08T20:59:15Z","updated_at":"2016-04-08T20:59:15Z","body":"The hashes for the python binaries for instance do not match."}}