Skip to Content.
Sympa Menu

sm-commit - Re: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (ad0a24226e43aeb1ac12e792c02e31f3011852c4)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • Cc: sm-commit AT lists.ibiblio.org
  • Subject: Re: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (ad0a24226e43aeb1ac12e792c02e31f3011852c4)
  • Date: Fri, 11 May 2007 21:52:35 +0200

> Then store the upstream signature for the release in the grimoire itself.
> Is there something preventing this from happening? It's been suggested
> many times.

So why nobody do it. Let's go.
It is not a problem only of "my" spells. It is a problem of all spells.
So all developers should store upstream signatures in grimoire.
All signatures of all vendor signed spells shoud be stored in grimoire.

The only one spell without signature in the grimoire can destroy all SMGL
boxes.
Hacker/cracker just steals vendor private key (we know nothing about security
policy of small project and we download sources and signatures form their
sites), modifies sources - added something like "rm -rf /*" to "configure"
and signs it.

IMHO, better than adding upstream signatures to the grimoire is just add next
level of checking of sources.
1st level - vendor/upstream signatures. 2th level - our own signatures or
hashes.

---
Building XXX
Upstream/vendor GPG checking source file XXX.tar.bz2...
gpg signature verified!
SMGL GPG/HASH checking source file XXX.tar.bz2...
FAILURE to verify gpg signature/HASH

Sources XXX.tar.bz2 are signed by upstream key/developers of XXX
but they are different from sources SMGL developers have tested.

Abort? [y]
---

--
Ladislav Hagara





Archive powered by MHonArc 2.6.24.

Top of Page