Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 11 Aug 2005, Jeremy Blosser (emrys) wrote:
> On Aug 10, Eric Sandall [eric AT sandall.us] wrote:
<snip>
> > My point is that users trust us to do at least minimal checking of
> > tarballs and the signing is, in it's basic sense, to make sure the
> > user is using the same tarball the guru did when he/she worked on the
> > spell. GPG is nicer than md5sum because you don't need to uncompress
> > the tarball before verifying it's validity (e.g. OpenOffice ;)) and
> > it's a better algorithm, at least so far.
>
> I guess I would note there that according to Seth's original mail
> announcing these API features[0], the new SOURCE_HASH for hash checking
> operates on the *compressed* tarball now.  And I'm not sure what
> specifically you mean is a better algorithm; if you mean GPG, I'd ask for
> more info, if you mean just the new libunpack() stuff, it's available for
> GPG or not.  I guess I was assuming at some point we'd expect everything to
> use the new libunpack() API, whether GPG or hash checking, and anything
> using old-style SOURCE_MD5 would be a bug.
>
> [0] https://lists.ibiblio.org/sympa/arc/sm-discuss/2005-April/010332.html --
> Seth does note in here that "SOURCE_GPG will be preferred" over
> SOURCE_HASH, but doesn't say why; I'd assume he means it's preferred
> because it provides better verification when appropriate key/source
> verification has been done to back it up.

IIRC GPG's hash algorithm is better than md5sum, sha1, etc. and can
easily be 'modified' if a hole/issue is found.

- -sandalle

- --
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us                  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFC+uQNHXt9dKjv3WERAj6mAJ4qvn0TlkU1fJS+avp4v/491FJKWwCdEnXY
Fbybe6nIO8vPJJSAfo7wmuE=
=+yzC
-----END PGP SIGNATURE-----