Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Clarifications on GPG signing of source tarballs

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Clarifications on GPG signing of source tarballs
  • Date: Wed, 17 Aug 2005 10:10:23 -0700

On Wed, Aug 17, 2005 at 09:50:05AM -0400, Sergey A. Lipnevich wrote:
> Hi All,
>
> This is a request for comments after the discussion started here:
> https://lists.ibiblio.org/sympa/arc/sm-discuss/2005-August/011831.html.
>
> Some of the spell I created started being signed by other SMGL
> maintainers. I'd like clarifications on such signatures, as opposed to
> ones coming from upstream. What do I, or any maintainer without a
> signature, do if I want to upgrade them to new version? I suppose I can
> either get the key and get it signed, or not.

We have this too:

SOURCEn_HASH=sha1:...

>
> In case I get the key, I'd gladly sign a *spell*, but I'm reluctant to
> sign a *source package* coming from its author(s). I don't trust any of
> the upstream package maintainers who don't sign tarballs themselves.
> It's not clear how I can make sure their packages are safe, but it's
> obvious that amount of work to make this happen it pretty high. I look
> at it this way: by signing a package from upstream, I implicitly give my
> trust to somebody I don't know. Would you consider signing a GPG key for
> somebody you don't know? It's the same question.

I suggest you create a key just for cache signing and don't sign it with
your own main key. That way it's not "trusted" within the standard pgp
web of trust, but is instead trusted by only our checking system via the
public key's being located in the gurus.gpg keyring.

I'd like to make a distinction between keys that are vendor-provided and
those that are guru-provided so we can announce that during the checking
process, and prefer vendor-signatures.

>
> The other alternative is to not get a key for myself. Am I allowed to
> convert a spell with SMGL maintainer signature back to MD5- or
> SHA-hashed source tarball when I upgrade it?

This is perfectly fine with me, but I suggest this format:

SOURCEn_HASH=sha1:...

And remember the _HASH requires the compressed sum, not uncompressed
like the old system (makes it faster and we deprecated FUZZ support).

> If no, I come back to trust
> issue above. If yes, what's the point of using those signatures?

The signatures just provide an option for a guru to say that they do
trust this to be accurate -- othewise, they should stick to a hash or
use a specialized unweboftrusted key.

>
> Ultimately, it comes down to the whether we require all maintainers to
> have GPG keys before they can work on grimoires, so this question must
> be addressed at a very high level of SMGL policies.

I think we should require official gurus to have a gpg keypair (which
they should already have for voting purposes).

Everybody else can use the _HASH format or include their public key
inside a keyring inside the spell directory for only checking that one
file.

>
> Finally, if I have to get a GPG key, how do I get it signed? I know
> there's nobody close to NYC contributing to SMGL, at least I think so.

For your signing key, not getting it signed and including it in
gurus.gpg by the fact that you have encrypted repository access is good
enough for me (although it would be better when we can eliminate all
unencrypted repository access). If somebody tried to submit your key to
gurus.gpg, we'd notice right away, way before it hit stable grimoire.

> Rutgers University nearby has an LUG, but I've never tried contacting
> them. What do people do in this case?

They go to a keysigning party where IDs are checked, or they have been
emailing for so long with the keys that they eventually become trusted
and signed by people. There's debate about what's better, but gnupg has
ways for you to place confidence in the ability of the keyholder to keep
their keys safe and to check other keys for validity (a meta-signing
that you only have to keep locally).

Seth

>
> Thanks,
> Sergey.
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733

Attachment: pgp3RqWNr0F10.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page