Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Wed, 31 Aug 2005 12:29:49 -0700

On Wed, Aug 31, 2005 at 06:51:56PM +0200, Ladislav Hagara wrote:
> > The beauty of hashes is that they don't need any extra support in
> > addition to
> > what's in sorcery now.
>
>
> Moreover, if there is some integrity problem, even users can discuss
> about their hashes, they can easily compare them.
> In p4 reviews I see ascii changes, not only "binary file was changed".

This is possible in PGP as well, not directly through gpg, they
suggested pgpdump could be modified to do something similar.

>
> Vendor signing is great but personally I would extra add our hash.
> What about if for example home page of wget is cracked, wget author's
> key is stolen, new tarball with "rm -rf /*" is created and signed?

Yeah, as said, we just include the sig locally.

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733

Attachment: pgpDugl8UA_68.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page