Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] verifying gpg keys

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] verifying gpg keys
  • Date: Thu, 11 Aug 2005 00:28:38 -0500

On Aug 10, Eric Sandall [eric AT sandall.us] wrote:
> On Wed, 10 Aug 2005, Jeremy Blosser (emrys) wrote:
> >On Aug 10, Eric Sandall [eric AT sandall.us] wrote:
> <snip>
> >>While this would be good for security reasons it may delay (and
> >>possibly discourage developers with already little free time) spells
> >>being updated due to the extra checks. It may also encourage gurus to
> >>continue using md5sums as the 'lazy' way to update a package. While
> >
> >Well, I don't see that users get a real benefit from developers using
> >guru GPG signatures for updates vs. checksums, if they aren't doing some
> >reasonable tarball validation to go with it. i.e. I don't see why it
> >matters if they take the 'lazy' way of just doing a checksum. (Note I'm
> >not really including md5sum, we'd want a better checksum, but those are
> >equally easy as md5 in the new setup.) Someone correct me if I'm missing
> >something there.
>
> My point is that users trust us to do at least minimal checking of
> tarballs and the signing is, in it's basic sense, to make sure the
> user is using the same tarball the guru did when he/she worked on the
> spell. GPG is nicer than md5sum because you don't need to uncompress
> the tarball before verifying it's validity (e.g. OpenOffice ;)) and
> it's a better algorithm, at least so far.

I guess I would note there that according to Seth's original mail
announcing these API features[0], the new SOURCE_HASH for hash checking
operates on the *compressed* tarball now. And I'm not sure what
specifically you mean is a better algorithm; if you mean GPG, I'd ask for
more info, if you mean just the new libunpack() stuff, it's available for
GPG or not. I guess I was assuming at some point we'd expect everything to
use the new libunpack() API, whether GPG or hash checking, and anything
using old-style SOURCE_MD5 would be a bug.

[0] https://lists.ibiblio.org/sympa/arc/sm-discuss/2005-April/010332.html --
Seth does note in here that "SOURCE_GPG will be preferred" over
SOURCE_HASH, but doesn't say why; I'd assume he means it's preferred
because it provides better verification when appropriate key/source
verification has been done to back it up.

Attachment: pgpVErRNn__kS.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page