🐛 FEATURE REQUEST: Distribute Nebula binaries more securely about nebula HOT 1 CLOSED

Hi @exercismnow -

Thanks for the feedback. All builds produced on our Releases page are generated via a Github Actions workflow. In order to sign them during the build process (to ensure that there was no post-build tampering prior to the signature) we would need to provide Github with a private PGP key - this means that if our Github repository is compromised, any builds created from it would inherently be signed by this PGP key. Therefore, I don't think that adding a PGP signature to the release process meaningfully improves user security.

However, from a given release page you will be able to see the tag it was created from. Typically @wadey creates these tags and he signs the tags before pushing them up using a local PGP private key. For example...

You can find recent workflow runs to verify that they were run against the signed tag: https://github.com/slackhq/nebula/actions/workflows/release.yml

Regarding your other suggestion:

Notify users of updates by distributing Desktop (Linux, Windows, Mac) binaries through repositories, or an official Flatpak. I'm not sure how exactly this would be done (not a technical expert). But if you could run nebula through commands obtained via a package manager, and then just download the configuration file from Github, that seems like a security improvement.

In general, we expect distributions to package Nebula themselves. Those distro maintainers will typically sign their packages and make their public keys available, usually as part of the package management tooling. For example, nebula package for Arch Linux and nebula package for Debian.

I hope this helps!

from nebula.