Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

Now that more gurus are converting spells to use gpg checking, I want to
suggest that we develop some kind of standards around the verification
expectations before we include a vendor key or sign a spell with a guru
key.  Right now it's just up to the gurus, but given the variance in
familiarity with gpg concepts, I think it's important we provide some
guidance so we're actually protecting our users with these schemes.

The big advantage of vendor-provided keys and signatures is that updating
the spell to a new upstream version just means changing the version number,
there's no per-version signature or hash update/verification.  The downside
of this is that if we just accept a key from the upstream server without
verifying it, and that key was itself compromised, we may have it for
multiple versions before realizing it.  Given that the vendor keys often
are found on the same upstream server the source comes from, this is a real
risk.  When we provide an upstream key in the grimoire we are representing
to users that we trust that key to be an authenticator that a source
tarball is not compromised.

I'm not suggesting we need to verify driver's licenses or passports or
anything.  But I think we should at least try to verify the key fingerprint
from a few disparate sources/channels.  We discussed this a bit on IRC and
noted that usually you can at least get it from a web site and the
keyserver, and hopefully you can find some mailing lists posts or archives
that also list it.  This isn't a ton of effort, especially since you only
have to do it once for each key.

Thoughts on this?  What kind of minimum should we try to establish?  I'm
going through right now converting a lot of the gnu software to gpg
checking, since they provide sigs for all their current software;
unfortunately those keys aren't very widespread and it's proving difficult
to get external validation for them, so this is also a pragmatic question.
I'll probably try mailing the authors for verification if nothing else, I
guess.


Guru-signed spells are harder.  We still have to verify the source per
release, but we probably should make sure people are doing more
verification here than they were probably doing with md5 sums.  Just
downloading the source and running md5sum or immediately signing whatever
you get is not "verification"; all you're doing is providing verification
to users that the (possibly compromised) source they're downloading is the
same as the (possibly compromised) source the guru got when they updated
the spell.  However, I don't know how per-release verification might work
for upstream vendors that don't care to provide something like sigs
already.

Attachment: pgpyLrpM9wtw9.pgp
Description: PGP signature