Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Thu, Apr 28, 2005 at 05:25:25PM -0500, David Kowis wrote:
> Seth Alan Woolley wrote:
> > On Thu, Apr 28, 2005 at 04:23:59PM -0500, David Kowis wrote:
> > Anything GPG-signed for use in a stable system requires a certain level 
> > of caution.  I'll make it not automatic, passphrased, and signed only 
> > once when I approve the release.
> One thing can be signed by multiple people right? Well, if each member
> of a team has their individual GPG key then they could sign it as they
> submit it to you and if it passes your check then you could sign it as well.

We have the ability to do something like that in libunpack, but since 
we're talking _basesystem only_ *reads subject*, I'll have them built 
already and don't need help except for one trusted person running a g3.

> 
> Or all members would submit their cache tarballs to each other, in a
> sort of distributed fashion, and they'd each check the others, sign them
> and pass them on. When a tarball has acquired all signatures, then it
> gets submitted to you for a final test.

You can't check a binary for a hole in it.

You just can't in the timeframe we're talking about.

> 
> Or, perhaps a process of some sort could be devised to pass them along
> through a series of different checks and if all parts pass then it'll
> have some number of signatures, assuring that it's 100% good.
> Then perhaps the automation could be an option.
> 
> Just trying to make it easier to create these things, because having
> someone physically check them all could take a while. Unless you weren't
> planning on physically checking them, in which case you've probably got
> something figured out already :)

This isn't a matter of physical checks.  The buck stops at _trust_.  Do 
I trust the person who sent me the binary?

> > 
> > Perhaps we can add a tool to import caches from one system to another by 
> > downloading with liburl and gpg-checking them with libunpack.  It could 
> > be called "wand" -- a tool to assist magic.  I could sure use such a 
> > procedure for all my boxes in odd places.  Tied with "cabal", updates 
> > would be easy to distribute.
> I like this idea. Especially if one has lots of computers of similar
> architecture.

I'm less concerned about optimizations as I am about customizability.

> 
> Don't know how hard any of this would be to implement, but I'm just
> throwing out ideas to keep our tarballs safe :)

I'm thinking if we expand beyond basesystem we have the names of the 
people creating the binaries public and chosen by a team (probably QA, 
but it could be their own team) -- of long-time, trusted members.

Seth

> 
> --
> One login to rule them all, one login to find them. One login to bring
> them all, and in the web bind them.
> http://shlrm.org
> http://www.zoominfo.com/DavidKowis
> http://www.flickr.com/photos/davidkowis
> 

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id 00BA3AF3 = 8BE0 A72E A47E A92A 0737  F2FF 7A3F 6D3C 00BA 3AF3
Quality Assurance Team Leader; Security Team Member, Leader Emeritus
Linux so advanced, it may as well be magic http://www.sourcemage.org
Elected Coordinating Committee Member, Secretary, and Finances Chair
Pacific Green Party of Oregon - Peace - http://www.pacificgreens.org

Attachment: pgpl0CxoYyKeA.pgp
Description: PGP signature