Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Wed, Aug 17, 2005 at 09:50:05AM -0400, Sergey A. Lipnevich wrote:
> Hi All,
> 
> This is a request for comments after the discussion started here:
> https://lists.ibiblio.org/sympa/arc/sm-discuss/2005-August/011831.html.
> 
> Some of the spell I created started being signed by other SMGL
> maintainers. I'd like clarifications on such signatures, as opposed to
> ones coming from upstream. What do I, or any maintainer without a
> signature, do if I want to upgrade them to new version? I suppose I can
> either get the key and get it signed, or not.

We have this too:

SOURCEn_HASH=sha1:...

> 
> In case I get the key, I'd gladly sign a *spell*, but I'm reluctant to
> sign a *source package* coming from its author(s). I don't trust any of
> the upstream package maintainers who don't sign tarballs themselves.
> It's not clear how I can make sure their packages are safe, but it's
> obvious that amount of work to make this happen it pretty high. I look
> at it this way: by signing a package from upstream, I implicitly give my
> trust to somebody I don't know. Would you consider signing a GPG key for
> somebody you don't know? It's the same question.

I suggest you create a key just for cache signing and don't sign it with 
your own main key.  That way it's not "trusted" within the standard pgp 
web of trust, but is instead trusted by only our checking system via the 
public key's being located in the gurus.gpg keyring.

I'd like to make a distinction between keys that are vendor-provided and 
those that are guru-provided so we can announce that during the checking 
process, and prefer vendor-signatures.

> 
> The other alternative is to not get a key for myself. Am I allowed to
> convert a spell with SMGL maintainer signature back to MD5- or
> SHA-hashed source tarball when I upgrade it? 

This is perfectly fine with me, but I suggest this format:

SOURCEn_HASH=sha1:...

And remember the _HASH requires the compressed sum, not uncompressed 
like the old system (makes it faster and we deprecated FUZZ support).

> If no, I come back to trust
> issue above. If yes, what's the point of using those signatures?

The signatures just provide an option for a guru to say that they do 
trust this to be accurate -- othewise, they should stick to a hash or 
use a specialized unweboftrusted key.

> 
> Ultimately, it comes down to the whether we require all maintainers to
> have GPG keys before they can work on grimoires, so this question must
> be addressed at a very high level of SMGL policies.

I think we should require official gurus to have a gpg keypair (which 
they should already have for voting purposes).

Everybody else can use the _HASH format or include their public key 
inside a keyring inside the spell directory for only checking that one 
file.

> 
> Finally, if I have to get a GPG key, how do I get it signed? I know
> there's nobody close to NYC contributing to SMGL, at least I think so.

For your signing key, not getting it signed and including it in 
gurus.gpg by the fact that you have encrypted repository access is good 
enough for me (although it would be better when we can eliminate all 
unencrypted repository access).  If somebody tried to submit your key to 
gurus.gpg, we'd notice right away, way before it hit stable grimoire.

> Rutgers University nearby has an LUG, but I've never tried contacting
> them. What do people do in this case?

They go to a keysigning party where IDs are checked, or they have been 
emailing for so long with the keys that they eventually become trusted 
and signed by people.  There's debate about what's better, but gnupg has 
ways for you to place confidence in the ability of the keyholder to keep 
their keys safe and to check other keys for validity (a meta-signing 
that you only have to keep locally).

Seth

> 
> Thanks,
> Sergey.
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
> 

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454  E082 99F0 69DC FDCE E733

Attachment: pgp3RqWNr0F10.pgp
Description: PGP signature