Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Tue, 30 Aug 2005 14:23:56 -0400

Quoting Eric Sandall <eric AT sandall.us>:

We're not asking you to sign your soul away. I cannot see how you are
completely missing the point of what we're saying. You are /not/
signing tarballs saying that you have audited the code (unless you
have, then you can say that), nor that you guarantee this tarball
won't break your computer, nor that this tarball has no viruses,
trojans, worms, wife beaters, etc. in it, nor that this tarball has no
bugs, nor many other things. The only thing the GPG signatures are for
is to replace the dependency on specific hashsums (md5sum, sha1sum,
etc.) and to allow for trusting the vendor's as much as we currently
trust them (I don't recall anyone doing audits of source code of any
packages for SMGL and no one complained that signing (yes, it's
technically a signature) with the md5sum said that you had done that).

Let me explain it differently because we keep walking around the same issue. The
users don't care no matter how you describe your use of signatures. I as a user
don't care how for example Apache Software Foundation describes their use of
signatures. When I, as a user, see a signature, I assume that they vouch for
contents of file, not just this file's integrity. That's how I treat
signatures. Tell me if I'm wrong, but you better have a good reason for it.
Maybe I as a user can go and read the authors' key policy, but ususally I'd do
that only when the actual problem comes up that prompts me to do so.

Even more so, Apache for example doesn't have any explanation. I tried searching
the site and I can't find a policy. Please find me a policy on some major OSS
vendor site that says: GPG signatures are used for integrity only and do *not*
mean non-repudiation and authenticity *of the code*. This file for example says
"signatures are used for code signing:"

http://svn.apache.org/repos/asf/lenya/trunk/KEYS

Did I make myself clear on why I don't care about what's written on our Web site
about signatures, and nobody else does? I hope I did. Please understand that
*this* point is the beef of my argument. I tried to express it as item #4 of my
original email, which was not understood well.

Now, as a maintainer, I am worried about perceived meaning of signatures. I do
not want my users to have a false feeling of security because the tarball is
signed. Moreover, I am not taking the responsibility of signing things I don't
read, even though you try to tell me that we have a disclaimer. With or without
this disclaimer, I can't do that.

Finally, I'm saying, and we agree on that at least with you Eric, that hash
values do allow for detection of integrity problems. I argue that they are
sufficient, and there's no reason to go further. If package authors sign their
packages, we support GPG verification, otherwise all bets are off. But please
understand that this is just a secondary reason of why I can't sign a tarball.
If there were no such thing as hash value, I couldn't sign an alien tarball
anyway.

Finally, Seth here is telling us that signatures do not mean security.
Regardless of whether I agree or disagree with this, please understand that
signatures are perceived as means to provide additional layer of... what?
correct, *security*! Why do I think so? Let me put our friend Andrew on the
spot (I'm sorry Andrew, you made it too easy with your email to make my point).
He recently wrote this:
https://lists.ibiblio.org/sympa/arc/sm-discuss/2005-August/011907.html

Citing it: "This is part of my new security policy I'm implementing for myself.
This key expires end of the year and I will issue a new one then."

So, people do perceive digital keys as a means of security. Not the only means,
of course, but definitely an important one. In the U.S., you can sign your name
now with the help of digital signature. Not GPG I think. Nevertheless, in the
public eye digital signature is very much alike the real deal. You can't try
and change this meaning just by posting a disclaimer on the site.

The question is, are we clear now on what I am objecting to?

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page