Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

On Aug 10, Eric Sandall [eric AT sandall.us] wrote:
> On Wed, 10 Aug 2005, Jeremy Blosser (emrys) wrote:
> > And while I know we don't have resources to do our own source audits, I
> > guess I might suggest that there should be a minimum verification that is
> > done before we as gurus sign a spell.  There's not a real value difference
> > between guru-signed or guru-checksummed, but there *is* more weight from a
> > user perspective behind the GPG signature being there, so we should 
> > perhaps
> > use that to let users know the level of verification we've been able to do
> > for a given release.
> >
> > Maybe something like: if you can verify the checksum at least 3 of the
> > same above 4 listed ways, you can guru GPG sign that release.  So, if they
> > provide a checksum on their website and their mailing list and somewhere
> > else, you can verify that checksum matches your download and sign it.
> > If you can't verify the checksum from 3 sources, you should only provide a
> > checksum in the spell yourself (hopefully something better than md5, but
> > the new verification lib supports some nice strong ones).  This shouldn't
> > require more work than we should be doing now, but it does let our users
> > that care about the differences know that "GPG Signature Verified" means
> > one level of validation has occurred, while "Checksum Verified" means
> > something objectively less.  This seems appropriate to me, and helps avoid
> > giving a false sense of security to users.
> >
> > Thoughts?
> 
> While this would be good for security reasons it may delay (and
> possibly discourage developers with already little free time) spells
> being updated due to the extra checks. It may also encourage gurus to
> continue using md5sums as the 'lazy' way to update a package. While

Well, I don't see that users get a real benefit from developers using
guru GPG signatures for updates vs. checksums, if they aren't doing some
reasonable tarball validation to go with it.  i.e. I don't see why it
matters if they take the 'lazy' way of just doing a checksum.  (Note I'm
not really including md5sum, we'd want a better checksum, but those are
equally easy as md5 in the new setup.)  Someone correct me if I'm missing
something there.

> the following is not a valid reason, people are used to easily and
> quickly updating packages and, for the users, seeing package updates
> the same day (sometimes within minutes) of a version release. Granted,
> some well-thought packagers already provide the necessary methods to
> verify tarballs, but the majority do not.
> 
> Is it worth the (perceived?) extra overhead for the extra security?

Given that guru GPG signing already incurs some extra overhead, I think
it's worth adding a bit more to have the presence of the guru GPG signature
mean something objectively useful, yes.  The world is full of security
checks that look impressive but are mostly applied as magical "pixie dust",
and in the end these tend to make things *less* secure because people
assume a level of security that isn't there in practice.  Having developers
who don't really understand dual-key crypto or have the time to do a
minimum level of download integrity verification doing tarball signing just
because "hey, GPG is impressive, and we support it" is not good security
practice, IMO.

Attachment: pgpDOtxug1mzT.pgp
Description: PGP signature