Google Summer of Code/2017/Ideas/Improve OpenPGP support for bugzilla

From Gentoo Wiki
Jump to:navigation Jump to:search

Improve OpenPGP support for bugzilla

Currently the OpenPGP bugzilla support is defunct in at least three ways:

  1. It encrypts to the first public key it considers viable[1], not respecting usage flags[2], leading to scenarios where the message is un-decryptable
  2. There is no mechanism for refreshing public keys from known public sources (e.g HKP keyservers) leading to a situation where subkey rotation or changers to primary certificate (e.g due to expiry or revocation) is not picked up automatically and needs to be manually adjusted, failure to do so can lead to encryption to a known non-viable certificate
  3. There is no group definition where multiple public keys can be assigned e.g to an alias account (security@) in bugzilla.

Having support for OpenPGP is necessary to retain confidentiality of restricted bugs in bugzilla, a lack of this results in information leakage. Alternatively, bug emails for group restricted bugs should not include metadata or data that can identify the issue, but merely report e.g "bug XXX has been updated, please log in to see the changes"

Contacts Required Skills
  • Perl
  • OpenPGP
References
  1. ↑ https://bugzilla.mozilla.org/show_bug.cgi?id=790487
  2. ↑ http://tools.ietf.org/html/rfc4880#section-5.2.3.21
Retrieved from "https://wiki.gentoo.org/index.php?title=Google_Summer_of_Code/2017/Ideas/Improve_OpenPGP_support_for_bugzilla&oldid=746993"