Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

On Aug 17, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
> Hi All,
> 
> This is a request for comments after the discussion started here:
> https://lists.ibiblio.org/sympa/arc/sm-discuss/2005-August/011831.html.
> 
> Some of the spell I created started being signed by other SMGL
> maintainers. I'd like clarifications on such signatures, as opposed to
> ones coming from upstream. What do I, or any maintainer without a
> signature, do if I want to upgrade them to new version? I suppose I can
> either get the key and get it signed, or not.
> 
> In case I get the key, I'd gladly sign a *spell*, but I'm reluctant to
> sign a *source package* coming from its author(s). I don't trust any of
> the upstream package maintainers who don't sign tarballs themselves.
>
> It's not clear how I can make sure their packages are safe, but it's
> obvious that amount of work to make this happen it pretty high. I look
> at it this way: by signing a package from upstream, I implicitly give my
> trust to somebody I don't know. Would you consider signing a GPG key for
> somebody you don't know? It's the same question.

I really agree with this, and it's part of why I was asking those
questions.  I will not sign a source tarball with my own keys without a lot
of verification it's at least the tarball upstream meant me to have, and
even then I'm iffy.  It's not my job to vouch for it with my personal key.
Yeah, that's probably not what signing the tarball means in this case, but
there's enough implications there I just don't want to go there.

I'll gladly verify and include upstream keys to check signatures they
provide, but otherwise I plan to stick with strong hashes that are verified
as much as is reasonable.

> The other alternative is to not get a key for myself. Am I allowed to
> convert a spell with SMGL maintainer signature back to MD5- or
> SHA-hashed source tarball when I upgrade it? If no, I come back to trust
> issue above. If yes, what's the point of using those signatures?

I think going back and forth between integrity check methods should be
fine.  If we implement something like the other discussion mentioned for
user-selectable integrity check strength requirements we leave it up to the
users what to make of it.

Attachment: pgpqu8Mco_0SN.pgp
Description: PGP signature