Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] verifying gpg keys

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] verifying gpg keys
  • Date: Wed, 10 Aug 2005 22:37:14 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 11 Aug 2005, Jeremy Blosser (emrys) wrote:
On Aug 10, Eric Sandall [eric AT sandall.us] wrote:
<snip>
My point is that users trust us to do at least minimal checking of
tarballs and the signing is, in it's basic sense, to make sure the
user is using the same tarball the guru did when he/she worked on the
spell. GPG is nicer than md5sum because you don't need to uncompress
the tarball before verifying it's validity (e.g. OpenOffice ;)) and
it's a better algorithm, at least so far.

I guess I would note there that according to Seth's original mail
announcing these API features[0], the new SOURCE_HASH for hash checking
operates on the *compressed* tarball now. And I'm not sure what
specifically you mean is a better algorithm; if you mean GPG, I'd ask for
more info, if you mean just the new libunpack() stuff, it's available for
GPG or not. I guess I was assuming at some point we'd expect everything to
use the new libunpack() API, whether GPG or hash checking, and anything
using old-style SOURCE_MD5 would be a bug.

[0] https://lists.ibiblio.org/sympa/arc/sm-discuss/2005-April/010332.html --
Seth does note in here that "SOURCE_GPG will be preferred" over
SOURCE_HASH, but doesn't say why; I'd assume he means it's preferred
because it provides better verification when appropriate key/source
verification has been done to back it up.

IIRC GPG's hash algorithm is better than md5sum, sha1, etc. and can
easily be 'modified' if a hole/issue is found.

- -sandalle

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFC+uQNHXt9dKjv3WERAj6mAJ4qvn0TlkU1fJS+avp4v/491FJKWwCdEnXY
Fbybe6nIO8vPJJSAfo7wmuE=
=+yzC
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page