Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Ismael Luceno <ismael AT iodev.co.uk>
  • To: Thomas Orgis <thomas-forum AT orgis.org>
  • Cc: Eric Sandall <eric AT sandall.us>, sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.
  • Date: Mon, 16 Mar 2020 23:55:58 +0100

On 16/Mar/2020 23:28, Thomas Orgis wrote:
> Am Mon, 16 Mar 2020 23:11:45 +0100
> schrieb Ismael Luceno <ismael AT iodev.co.uk>:
>
> > I suggest the deprecation of the feature as a primary means of
> > verification.
>
> … and sorcery could switch to not using gpg for sha512, I guess? That's
> quite a bit of code gone from our sensitive toolchain.
>
> /var/lib/sorcery/modules/libunpack:
>
> ## In HASH mode:
> ## Validates the verification level (the third parameter) and the
> ## hash algorithm against user defined lists.
> ## It uses gpg to calculate the hash value except for md5 and sha1, which
> ## coreutils provides.
> ## see unpack_hash()
>
> $ gaze from sha256sum
> coreutils-8.30: /bin/sha256sum
> coreutils-8.28: /bin/sha256sum
> $ gaze from sha512sum
> coreutils-8.30: /bin/sha512sum
> coreutils-8.28: /bin/sha512sum

The comment is outdated, it doesn't depend on gpg anymore.




Archive powered by MHonArc 2.6.24.

Top of Page