Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

Here I go replying to myself again...

On Aug 17, Jeremy Blosser (emrys) [jblosser-smgl AT firinn.org] wrote:
> 3) Upstream keys are always preferred, since they maintain a complete
>    validation chain of the source and require the least ongoing
>    maintenance for gurus.  However, before including an upstream key in
>    the grimoire(s), gurus should attempt to verify the key at least
>    three of the following ways:
> 
>    a) Get the key/fingerprint from the primary distribution site for the
>       package in question.
> 
>    b) Get the key from one of the public keyservers (either pgp.mit.edu
>       or subkeys.pgp.net).
> 
>    c) Get the key/fingerprint from an official post to a mailing list
>       for the package in question.
> 
>    d) Have a version of the key that is signed by a key we already
>       include and have three-method verification for.

I forgot:

     e) Confirm the fingerprint via private email/mail/IRC chat/phone/etc.
        with the upstream key owner.

Are there more?

>    "Validation" means that the fingerprint retrieved in the above method

s/Validation/Verification/

>    The exact level specification has not been determined yet, but the
>    following has been suggested and seems to have consensus:
>   
>    a) Level 0: Verification is explicitly not included.  
>   
>    b) Level 1: The guru downloaded the sources from the primary upstream
>       distribution site and verified they compiled and ran.
>     
>    c) Level 2: The guru verified the downloaded sources matched a hash
>       published by the upstream authors.
> 
>    d) Level 3: The spell is using an upstream key which has been
>       verified using at least one of the above listed methods.

This is probably redundant as worded, since if you get the key from any
authoritative source, it "counts" as one verification method.  This is
clearer:

     d) Level 3: The spell is using an upstream key obtained from the
        primary upstream distribution site.

> 
>    e) Level 4: The spell is using an upstream key that has been verified
>       using three of the above listed methods.

Should we add:

     f) Level 5: The spell is using an upstream key that has been verified
        in person via an official ID check.

for the Very Paranoid/ID Check Obsessed?

Attachment: pgpdGcTJ1nWYb.pgp
Description: PGP signature