Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Wed, 31 Aug 2005 23:27:08 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 31 Aug 2005, Sergey A. Lipnevich wrote:
<snip>
Further, if you truly believe that someone signing a package is making a
claim they have audited the source, and you believe that other people share
this believe, you *should* be opposed to anyone signing something and
making that claim, because it would put our users and even our distribution
in jeopardy. In fact, if you believe signatures mean what you say you do,
you should probably be opposed to use included upstream signatures, because
those vendors make it clear in their other documents that they disclaim all
warrantees. If providing an upstream signature is going to make most users
believe they have guarantees they do not have, we would be irresponsible to
include them.
<snip>
Remember how long it took for GNU to recover after their servers were
breached? Why do you think it was? If they disclaim all warranties, why
would they take it upon themselves to verify each and every file before
putting it back on the server. And not just verify, but go back to the
author(s) of each source and make sure they verify it? Obviously, this
involves trust. They feel that they have to keep your trust in taking
the breaches seriously. If I were put in this position, I would be very
disappointed that something I signed could not be trusted.
<really big snip>

I believe the reason they went and verified every tarball has nothing
to do with whether they used GPG to sign it, but everything to do with
them not wanting to put a corrupted tarball up again after having been
alerted to it and spending all this time taking them down, causing
inconvenience to many. This argument has nothing to do with GPG
signing, so I don't know why you brought it up.

- -sandalle

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDFp8+HXt9dKjv3WERAthBAJ9Q4ZmwxDi0CdubOjVJ+OkG+S+ElQCgw1yl
w8F0lcPoG5sN8DIrTxn97nU=
=Au3p
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page