Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Thu, 1 Sep 2005 14:27:02 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 1 Sep 2005, Sergey A. Lipnevich wrote:
This is interesting:
http://ask.slashdot.org/article.pl?sid=05/08/31/2045201
It pretty much repeats our discussion in this thread, with arguments
from both sides.

Points #2, #3, and #4 just reinforce what I (and others) are saying
about how GPG keys can be used. Point #1, IMO, for SMGL is that the
developers would do some checking (which is in our policy) that the
vendor key we're about to use is legit.

I especially like this fragment:
http://ask.slashdot.org/article.pl?sid=05/08/31/2045201#13450029

Why? All he's saying is that since Fedora is setup to require GPG
keys, but no packages are signed (or he had the wrong key), he just
turned off GPG checking. We wouldn't have that problem as there is no
user-interaction for adding/removing keys.

and this one
http://ask.slashdot.org/article.pl?sid=05/08/31/2045201#13450266

This one just points out the representation to users giving them a
mistaken idea about what the GPG key is for, not about users being
mistaken about what GPG can be used for.

Even if you want to ignore the presentation part, the poster here goes
on to say that it'd work in a tightly-controllerd environment. That
would be SMGL: Only select individuals (authors or our developers)
setup the keys, not any Joe Blow, and we tend to go through a
verification process for the keys as well (for vendor-sigs).

There are of course pieces in support of signatures, but I'm going to
leave searching for them for those interested :-).

Funny that the ones you pointed out hurt your case more than help it.

- -sandalle

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDF3IqHXt9dKjv3WERAi4eAKDLIsVt7gDEKkGP0hc+VyxZpOgaRgCdHFeA
W+C/J877Ls1Rb4fei8vsKvo=
=7Xn3
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page