Security — Odyssey Linux

THE ARGUMENT

Let me start from an assumption nobody makes in the Linux world: I consider the concept of trust outdated. Read the continuous stream of CVEs, or look at what happened with the AUR. With the infrastructure I built for Odyssey's supply chain I want to rely on a robust model, and above all a mathematically verifiable one, with public registries anyone can consult, independent even from me.

First thing, so we are clear: most Odyssey packages come from Void. This model is built for my repository and my packages, and they are genuinely few, under a hundred. But that is not the important part. The infrastructure is what counts, and the long term plan is to bring more and more packages inside our repository and our supply chain.

Here is how it starts. The upstream source is scanned with open source tools looking for certain patterns: exfiltration of SSH keys, cryptominers, intrusive actions. And above all, a system computes the difference against the previous version of the package and analyses it. That is exactly where most of the problems with Linux packages built from upstream sources are born, and XZ is the clearest example.

Nothing is blocked automatically. When the scanner finds something I get a notification and I look at it by hand, because a machine cannot tell a real backdoor from a noisy but legitimate change. What passed, what was stopped and what I cleared myself is all public in the scan record.

Past that stage, packages are compiled reproducibly. Taking inspiration from the Guix challenge, I built odyssey-challenge: it lets anyone replicate the check and publish it in an immutable online registry that not even I can alter.

The verification keys are two, and they sign each other. RSA because that is what xbps uses to sign the repository, and cosign because that is the signature that goes into Rekor, the public transparency log run by the Sigstore project under the Linux Foundation. The cosign private key lives on a YubiKey 5C NFC: it cannot be extracted or copied, not even by me.

On top of this chain an independent scanner runs continuously, on a different machine from the server, verifying the state of the packages. It is an enforcement system: if a key has a problem, if a package is tampered with, it cannot slip away unseen. It is visible to everyone, both on the status page and inside the package manager, in the repository status section.

WHAT THIS DOES NOT COVER

It does not cover Void's own upstream sources, which is where most of what you install still comes from.

It does not cover my build machine. If that were compromised, the signatures would still come out valid: that is exactly what the independent watchdog and your own rebuild are for.

And it does not cover anything you add yourself from third party repositories. No chain protects you from that.

THE PROOF

+Verify any package30 seconds

curl -LO https://repo.odysseylinux.org/odyssey-repo/x86_64/PACKAGE.xbps
curl -LO https://repo.odysseylinux.org/odyssey-repo/x86_64/PACKAGE.xbps.cosign.bundle

cosign verify-blob --key cosign.pub \
    --bundle PACKAGE.xbps.cosign.bundle \
    PACKAGE.xbps
→ Verified OK

If it returns Verified OK, the package is exactly what was signed, and that signature exists permanently in the public log. It cannot be removed or altered.

+Verify the attestationthe two keys

Confirm that each key really vouches for the other.

# get the files
git clone https://code.odysseylinux.org/nobody/odyssey-keys
cd odyssey-keys

# 1 — cosign (ECDSA) signature + Rekor record
cosign verify-blob --key cosign.pub \
    --bundle odyssey-key-attestation.txt.cosign.bundle \
    odyssey-key-attestation.txt

# 2 — ether-repo (RSA) signature
base64 -d odyssey-key-attestation.txt.xbps-sig.b64 > sig.bin
openssl dgst -sha256 -verify ether-repo.pub \
    -signature sig.bin odyssey-key-attestation.txt

+The public keys2

cosign · ECDSA P-256 · verifies .cosign.bundle-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbmmxcFQUDNphGAjTJZqDcgPE7Jok vvjatj5Jposqos8Y276mV9U6TLoF6is44DZcR+M9T2wxMPUilJLzJvJtIw== -----END PUBLIC KEY-----

ether-repo · RSA 4096 · verifies the xbps repository-----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq06tNJ0pG4RX3ieRNH8K Imkk1mAcSuM+PmgaUZOwKMfwKC/KPGteCnYCtn2qT3JqUiYdeBR1X92ZDHJwb5q7 JKEgBABxPwHFNCRgOViKvp5UHi9osTIBCILc8D6yHFi4bm3j3d2ehYSH4gmWBiO/ Rx3mb54bXdlxOMHNPnc9KUmxTy8tOxn/cbL69tqaEXPdgqmLtwghzotdoODIOjnw 83ep6pag/IBcA5kzaHIZGx/7k2bW80kTNeEZjZKAx/tEaja2tQLpTlmfesKGfCi1 W7AKrP0HlE9bTZQHhPdDjmp4sLUF9elVnMZ/qC1+hT7BIfMKLHlGM3QpXDl7N8iC NPjtUYx8edHNHINK3s79z5lhTGnmUyZ8CAngr3bRLdIHbRMn30UUUi/c6hLOmr9a YbZC+TthZ+Y3Sz9iI1FBDed7uV5DtTl9i0qr5zuaURmvlqUbVTqzOYpdxGTO4aeJ bIvElQOP2kfGWGjF5r6bdOzLBr+fdsvElyh9JAbefEfY0Zq4CxOge6rHGpeIm45m dTtu2oV608+pKPsLdAoRX/nZX+id/WX1Z9ueRBQOxdEbQUIOm63CZrSOETY8mwct 5a/E+M+YUQWQDtLYrADbdtLBnvKcgvoRd19AXPdcYEoAb7i38Bl6rQXdimClCYyI fsYlk/x8O25vb2NHv2n0bzUCAwEAAQ== -----END PUBLIC KEY-----

Both keys, and the attestation that links them, are published at code.odysseylinux.org/nobody/odyssey-keys. Trust a new or replacement key only if it is announced through both this page and the Forgejo repository.

+Rebuild it yourselfodyssey-challenge

Rebuild a package from source, compare the hashes, and publish an attestation signed with your own key. Nobody has to take my word for it, not even you.

full guiderebuild and attest→

+The public recordlive

scan recordwhat passed, what was stopped→ statuscurrent integrity verdict→ codeevery recipe, in the open↗

+Found a security problem?disclosure

Report it privately. Do not open a public forum thread, that would expose the issue before it can be fixed.

security@odysseylinux.org

Include what you found, how to reproduce it, and how to reach you. Good faith research is welcome.