Skip to Content.
Sympa Menu

sm-discuss - [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Thomas Orgis <thomas-forum AT orgis.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.
  • Date: Thu, 27 Feb 2020 11:06:15 +0100

Dear Realm of Source Mage,

I want to draw attention to a commit message I drafted as a kind of
manifesto, after I got verification failure on casting wget. Please
discuss.

commit cc06516b86e1cdbbbc172b1d7563246fe49b034a
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Thomas Orgis <sobukus AT sourcemage.org>

wget: switch to hash instead of flaky GPG sig

1. The key that used to work from gnu.gpg expired last year and
apparently because of that fact got silently removed on the recent
update of gnu.gpg (13a891ca5be812258e068c84e7076f563a338e7c).

2. The new signing key of the main author is only rather indirectly
associated with the project (a person claiming the name of the current
author responded on Stack Overflow 4 years ago to a question about how
to verify wget sources, seriously). Putting the Key ID on the wget website
would give it some HTTPS-based weak trust. But so … nothing.

I fail to see the advantage of possibly trusting changed versions of
the source tarball when the (blindly) trusted key is used to make another
sig along with it. We want to ensure that the exact same source is used
for repeated builds. A check of a signature without at least storing
a hash of that signature itself does not provide that.

Upstream signatures are there for the guru to verify and establish trust
before writing the hash into DETAILS (bonus points for a system that
stores multiple hashes and file size for added robustness, as pkgsrc
does). After that, hashes stored in the grimoire are the only sensible
truth to ensure that the downloaded sources are a) verified and
b) identical to those tested by the guru working on the spell.

I hope we can agree on ending the nonsense of managing (and failing at
that,
as seen in this case) piles of gpg keys in grimoire keyrings. We got
better
things to do.


Someone got compelling arguments for continuing the versioning of
binary GPG key blobs in the grimoire that are growing considerably in
size and also do not provide the kind of trust we need (like, ensuring
getting identical sources)?


Alrighty then,

Thomas





Archive powered by MHonArc 2.6.24.

Top of Page