Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Wed, 31 Aug 2005 23:12:11 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 31 Aug 2005, Sergey A. Lipnevich wrote:
Quoting dave AT sourcemage.org:
<snip>
Your fellow devlopers are telling you the truth dude.

What exactly do you mean? The part that the signature allows to check for
authenticity of the package and the identity of the originator, established
with Seth's help, I actually agree with. Hence my objection to being such an
originator. Disclaiming authenticity and identity means that only integrity is
left. And we agree I believe that integrity is adequately assured by hashes.
Eric suggested stronger hashes. I agreed.

For clarification I was and am not agreeing that I think we should
stick with specific hashes for any reason, but was merely pointing out
that, if it is decided to keep SOURCE_HASH, that we should at least
use the same hash strength as that used by default, for now, of the
proposed replacement, GPG.

Moreover, I am suggesting moving to an SCM system that has built-in commit
signatures. If I'm not mistaken, Montone can do that, and Subversion with
client certificates (not using PGP, but e-commerce style PKI).

We're currently looking at other SCMs and so far svk and bzr
(bazaar-ng) look the most promising, but both still fall short[0].

<snip>
The very idea that so
many of the primary developers of this project would be asking you to do
something grossly irresponsible, or worse, trying to trick you into it
with word games is adolescent and ridiculous. Look at the guys who are

It is. To me it's ridiculuos too that I have to sign (assure authenticity and
identify myself as originator of ) a package I didn't inspect under pressure
from fellow developers.

That's because, IMO, you're refusing to see the light. We're not
saying you've inspected the package in any way other than what you're
currently doing with md5sums: download, cast, run. Worked? Yes, then
update. Didn't work? Find out why, fix if possible, update if it
works, otherwise WIP or ignore.

<snip>
the leadership of SMGL, or that your understanding of signatures might
have been a bit off.

I understand signatures correctly. That's why I don't sign things blindly to
begin with.

You're not signing it blindly, you're 'testing' the tarball the same
amount (see above) as you do with md5sums. We're just moving the
dependency on a specific has to a dependency on a program that
supports many hashes and has a team devoted to making sure the default
keys are 'safe'.
<snip>

- -sandalle

[0] http://www.sourcemage.org/node/1540

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDFpu8HXt9dKjv3WERApfJAKCqVSgi15SROvsD62C+s2FK3fAfhgCfQLYX
5fuwB20odxaMeJ6thuZNPfs=
=C0UW
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page