Re: [Sidrops] what to do when the CRL is hosed?

[Robert Kisteleki <[e-mail]>]

> There are potentially transitional states in the production of a large
> repository under eventually consistent production (e.g. multiple
> asynchronous cooperating processes, dual-redundant signing models)
> where what can be fetched and what is on manifest do not align.  If we
> wish to demand that the manifest and a given state of the repository
> *always* align, we need to formalise that in a way which makes it
> clear we publish repository state in as close to atomic-update as
> possible. (copying a repo to a new dir, modifying the contents of the
> new dir, and (re)publishing the change through the rename() call in
> UNIX is one such model)

Being smart on the repo side surely decreases the probability of a
hickup, but I don't think it can completely avoid point-in-time
inconsistencies. So the RP has to be prepared to deal with this.
Assumptions about a repo always being self-consistent will not hold up,
even without an attacker around.

(I also recall that, at least in theory, there is such a thing as a
"repository service" where one can use a private CA but someone else's
repo to publish. Such a scenario compicates the consistency requirement
even further.)

Robert