Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

All this looks good so far, I'd accept your friendly amendments below 
too and add another friendly amendment:

It is a valid bug that level 5 is not attained on all spells with caches 
distributed on our ISOs.

Seth

On Wed, Aug 17, 2005 at 01:54:26PM -0500, Jeremy Blosser (emrys) wrote:
> Here I go replying to myself again...
> 
> On Aug 17, Jeremy Blosser (emrys) [jblosser-smgl AT firinn.org] wrote:
> > 3) Upstream keys are always preferred, since they maintain a complete
> >    validation chain of the source and require the least ongoing
> >    maintenance for gurus.  However, before including an upstream key in
> >    the grimoire(s), gurus should attempt to verify the key at least
> >    three of the following ways:
> > 
> >    a) Get the key/fingerprint from the primary distribution site for the
> >       package in question.
> > 
> >    b) Get the key from one of the public keyservers (either pgp.mit.edu
> >       or subkeys.pgp.net).
> > 
> >    c) Get the key/fingerprint from an official post to a mailing list
> >       for the package in question.
> > 
> >    d) Have a version of the key that is signed by a key we already
> >       include and have three-method verification for.
> 
> I forgot:
> 
>      e) Confirm the fingerprint via private email/mail/IRC chat/phone/etc.
>         with the upstream key owner.
> 
> Are there more?
> 
> >    "Validation" means that the fingerprint retrieved in the above method
> 
> s/Validation/Verification/
> 
> >    The exact level specification has not been determined yet, but the
> >    following has been suggested and seems to have consensus:
> >   
> >    a) Level 0: Verification is explicitly not included.  
> >   
> >    b) Level 1: The guru downloaded the sources from the primary upstream
> >       distribution site and verified they compiled and ran.
> >     
> >    c) Level 2: The guru verified the downloaded sources matched a hash
> >       published by the upstream authors.
> > 
> >    d) Level 3: The spell is using an upstream key which has been
> >       verified using at least one of the above listed methods.
> 
> This is probably redundant as worded, since if you get the key from any
> authoritative source, it "counts" as one verification method.  This is
> clearer:
> 
>      d) Level 3: The spell is using an upstream key obtained from the
>         primary upstream distribution site.
> 
> > 
> >    e) Level 4: The spell is using an upstream key that has been verified
> >       using three of the above listed methods.
> 
> Should we add:
> 
>      f) Level 5: The spell is using an upstream key that has been verified
>         in person via an official ID check.
> 
> for the Very Paranoid/ID Check Obsessed?



> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss


-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454  E082 99F0 69DC FDCE E733

Attachment: pgpH4eE7ANZnq.pgp
Description: PGP signature