Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Summary of GPG Discussions / For Real Proposal

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Summary of GPG Discussions / For Real Proposal
  • Date: Wed, 17 Aug 2005 12:23:42 -0700

All this looks good so far, I'd accept your friendly amendments below
too and add another friendly amendment:

It is a valid bug that level 5 is not attained on all spells with caches
distributed on our ISOs.

Seth

On Wed, Aug 17, 2005 at 01:54:26PM -0500, Jeremy Blosser (emrys) wrote:
> Here I go replying to myself again...
>
> On Aug 17, Jeremy Blosser (emrys) [jblosser-smgl AT firinn.org] wrote:
> > 3) Upstream keys are always preferred, since they maintain a complete
> > validation chain of the source and require the least ongoing
> > maintenance for gurus. However, before including an upstream key in
> > the grimoire(s), gurus should attempt to verify the key at least
> > three of the following ways:
> >
> > a) Get the key/fingerprint from the primary distribution site for the
> > package in question.
> >
> > b) Get the key from one of the public keyservers (either pgp.mit.edu
> > or subkeys.pgp.net).
> >
> > c) Get the key/fingerprint from an official post to a mailing list
> > for the package in question.
> >
> > d) Have a version of the key that is signed by a key we already
> > include and have three-method verification for.
>
> I forgot:
>
> e) Confirm the fingerprint via private email/mail/IRC chat/phone/etc.
> with the upstream key owner.
>
> Are there more?
>
> > "Validation" means that the fingerprint retrieved in the above method
>
> s/Validation/Verification/
>
> > The exact level specification has not been determined yet, but the
> > following has been suggested and seems to have consensus:
> >
> > a) Level 0: Verification is explicitly not included.
> >
> > b) Level 1: The guru downloaded the sources from the primary upstream
> > distribution site and verified they compiled and ran.
> >
> > c) Level 2: The guru verified the downloaded sources matched a hash
> > published by the upstream authors.
> >
> > d) Level 3: The spell is using an upstream key which has been
> > verified using at least one of the above listed methods.
>
> This is probably redundant as worded, since if you get the key from any
> authoritative source, it "counts" as one verification method. This is
> clearer:
>
> d) Level 3: The spell is using an upstream key obtained from the
> primary upstream distribution site.
>
> >
> > e) Level 4: The spell is using an upstream key that has been verified
> > using three of the above listed methods.
>
> Should we add:
>
> f) Level 5: The spell is using an upstream key that has been verified
> in person via an official ID check.
>
> for the Very Paranoid/ID Check Obsessed?



> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss


--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733

Attachment: pgpH4eE7ANZnq.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page