Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

> You can use whichever method you want, but GPG checking (see above) is
> preferred.

My goals are inspired by this:

http://www.cryptnet.net/fdp/crypto/strong_distro.html#ss1.1

Ultimately every spell that is updated (granted some spells are simply 
not updated frequently like netcat) should have a vendor gpg signature, 
not a guru signature.

If they don't want to do that, then we aren't fully strong.  This is 
something we'll probably have to live with.

On the other hand, it is entirely possible to get the basesystem fully 
strong.

I'll note that rpm, for example, has gpg signature checking, however, 
their use of that checking is "yes, this came from me" and not "no, it 
has no <list of malicious things>".  You can really only make an 
affirmative statement with most things with any surity.  We now at least 
have this capability.

This strong distribution shouldn't depend on people trusting us for the 
source -- people want to be able to trust us for as little as possible 
(the auditable spells and sorcery and iso basesystem for example).  By 
letting the computer that's doing the compiling check the vendor 
signature as well, we're being truly open.

Now, as we discussed before, this does leave us to the question of how 
we check the vendor keys for inclusion.  As I suggested before, we can 
have a committee of people directly responsible for validating vendor 
keys even if it means meeting the individual, taking their picture, 
checking ID, or other means.  Once the vendor keys have been validated, 
we can have a special key the committee chair has that can sign the 
vendor keys.  We'd also have the requirement that the vendor be 
trustworthy (do basic background checks).

At that point, we can delegate responsibility to the vendor for "this 
hasn't been tampered with maliciously" -- taking it directly to the 
source where it should be most accurate from a man-in-middle attack 
vector (there are other vectors of attack, too).  Thus we stay true to 
our "don't mess with the vendor's source if we can" philosophy.

Seth

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454  E082 99F0 69DC FDCE E733

Attachment: pgp1EH_VCOVbn.pgp
Description: PGP signature