Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Clarifications on GPG signing of source tarballs

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: Eric Sandall <eric AT sandall.us>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Clarifications on GPG signing of source tarballs
  • Date: Wed, 17 Aug 2005 10:45:27 -0700


> You can use whichever method you want, but GPG checking (see above) is
> preferred.

My goals are inspired by this:

http://www.cryptnet.net/fdp/crypto/strong_distro.html#ss1.1

Ultimately every spell that is updated (granted some spells are simply
not updated frequently like netcat) should have a vendor gpg signature,
not a guru signature.

If they don't want to do that, then we aren't fully strong. This is
something we'll probably have to live with.

On the other hand, it is entirely possible to get the basesystem fully
strong.

I'll note that rpm, for example, has gpg signature checking, however,
their use of that checking is "yes, this came from me" and not "no, it
has no <list of malicious things>". You can really only make an
affirmative statement with most things with any surity. We now at least
have this capability.

This strong distribution shouldn't depend on people trusting us for the
source -- people want to be able to trust us for as little as possible
(the auditable spells and sorcery and iso basesystem for example). By
letting the computer that's doing the compiling check the vendor
signature as well, we're being truly open.

Now, as we discussed before, this does leave us to the question of how
we check the vendor keys for inclusion. As I suggested before, we can
have a committee of people directly responsible for validating vendor
keys even if it means meeting the individual, taking their picture,
checking ID, or other means. Once the vendor keys have been validated,
we can have a special key the committee chair has that can sign the
vendor keys. We'd also have the requirement that the vendor be
trustworthy (do basic background checks).

At that point, we can delegate responsibility to the vendor for "this
hasn't been tampered with maliciously" -- taking it directly to the
source where it should be most accurate from a man-in-middle attack
vector (there are other vectors of attack, too). Thus we stay true to
our "don't mess with the vendor's source if we can" philosophy.

Seth

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733

Attachment: pgp1EH_VCOVbn.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page