Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Ismael Luceno <ismael AT iodev.co.uk>
  • To: Eric Sandall <eric AT sandall.us>
  • Cc: sm-discuss AT lists.ibiblio.org, Thomas Orgis <thomas-forum AT orgis.org>;
  • Subject: Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.
  • Date: Mon, 16 Mar 2020 23:11:45 +0100

On 06/Mar/2020 10:19, Eric Sandall via SM-Discuss wrote:
> On 2/28/20 07:14, Thomas Orgis wrote:
> > Am Thu, 27 Feb 2020 11:06:15 +0100
> > schrieb Thomas Orgis <thomas-forum AT orgis.org>:
> >
> >> Upstream signatures are there for the guru to verify and establish
> >> trust
> > For that purpose, I'd really like the gpg files from the grimoire to be
> > moved to a spell (the files themselves moved into an archive to be
> > summoned) which installs something like /usr/share/upstream-keys/*.gpg .
> > That way, they're actually more easy to use for interactive
> > verification, with a known location, and we get rid of the binary blobs
> > in the grimoire itself. That's 425 files with about 4M size total.
> > The're a bit compressible, so the net effect on grimoire.tar.bz2 is
> > from 13M to 10M if we leave them out.
> >
> > Thinking about this … a central collection of the “right” public keys
> > to verify open source releases with would be useful in its own right. A
> > kind of trusted versioned keyserver (database archive with known hash).
> > Of course it would've been nice if the Web Of Trust had worked out, but
> > I don't see that happening. I myself am also guilty of not seing the
> > point in attending a key-signing event even when I was in the vicinity.
> >
> > At least for the Source Mage project, an smgl-upstream-keys spell could
> > provide the same level of trust we have right now to the keys collected
> > in the grimoire. I like the idea of separating them into a spell even
> > if we keep on-cast GPG verificaton in combination with hash checking.
> > We could add support for the admin to add
> > to /usr/share/uptream-keys/local.gpg
> > (or /usr/local/share/upstream-keys/add.gpg, whatever) to have keys
> > marked as trusted for anything (even self-signing all sources once, for
> > some strange reason).
> >
> >
> > Alrighty then,
> >
> > Thomas
>
> Those are all great points. :) I believe the UPSTREAM_GPG_KEY was when
> we assumed that upstream would /always/ be a trusted source. It also
> avoided the issue when a tarball was re-relased without a new version
> tag, but was still properly signed, then we didn't have to do our own
> /diff/ of the source code, do some sleuthing, and then update the
> SOURCE_HASH ourselves so that further casts would work. They're also
> convenient as we don't need to generate a hash on upgrades. ;)
>
> I agree with the overhead and us keeping track and verifying the GPG
> trustworthiness. I don't see much of a downside for going back to
> SOURCE_HASH only (some SMGL devs still use SOURCE_HASH instead of GPG
> even when available). This would also avoid the issue of when gnupg
> breaks (e.g. some upgrades) and we can no longer cast spells with source
> validation until we fix it.
>
> -Eric

+1 to all points.

I suggest the deprecation of the feature as a primary means of
verification.




Archive powered by MHonArc 2.6.24.

Top of Page