Verified Debian Packaging at Scale
summary
Cloudflare proves every executable on 330+ city Debian hosts is signed and verified before execution by using Linux IMA appraisal and embedding signatures into packages. The work patches dpkg to add a post-unpack invoke hook, adds tooling (dpkg-oodles and ima-package-signer) to embed extended-attribute signatures, and uses an Aptly-based mirror workflow to sign upstream repos (70k packages signed in ~20 minutes). A kernel patch implements IMA selective enforcement to enforce signed files while logging unsigneds; next steps cover containers and full fleet rollout.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:05Cloudflare infrastructure
- 4:18Security incident
- 6:05Trusted software requirements
- 8:11Debian and GPG signatures
- 9:14Linux Security Modules and IMA
- 12:44Shipping extended attributes
- 15:52Signatures in Debian packages
- 17:58Custom package signing tools
- 19:01End-to-end signing workflow
- 20:05Signing a Debian repository
- 22:51Enforcing signature coverage
- 23:55Future plans
- 24:39Q&A
related talks
33mBinary Policy with IMA and AppArmor
37mSupply Chain Security in Kubernetes
31mSigned, Sealed, Delivered - Sign and Verify All the Things
28mKnow Your Kubernetes Deploys
46mVerifiable End To End Secure OCI Native Machines
32mSigning distribution artifacts with Signstar
45mSponsored Session: Because Security Matters: Securing Your Open Source Supply Chain
43mCIP (Civil Infrastructure Platform): Reusing and Strengthening OSS Component Securi...