Public SourceMage Discussion List

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

Thanks for putting this together. I filed a bug to add support for the
verification level field to sorcery.

-Andrew

On Wed, Aug 17, 2005 at 01:54:26PM -0500, Jeremy Blosser (emrys) wrote:
> Here I go replying to myself again...
> 
> On Aug 17, Jeremy Blosser (emrys) [jblosser-smgl AT firinn.org] wrote:
> > 3) Upstream keys are always preferred, since they maintain a complete
> >    validation chain of the source and require the least ongoing
> >    maintenance for gurus.  However, before including an upstream key in
> >    the grimoire(s), gurus should attempt to verify the key at least
> >    three of the following ways:
> > 
> >    a) Get the key/fingerprint from the primary distribution site for the
> >       package in question.
> > 
> >    b) Get the key from one of the public keyservers (either pgp.mit.edu
> >       or subkeys.pgp.net).
> > 
> >    c) Get the key/fingerprint from an official post to a mailing list
> >       for the package in question.
> > 
> >    d) Have a version of the key that is signed by a key we already
> >       include and have three-method verification for.
> 
> I forgot:
> 
>      e) Confirm the fingerprint via private email/mail/IRC chat/phone/etc.
>         with the upstream key owner.
> 
> Are there more?
> 
> >    "Validation" means that the fingerprint retrieved in the above method
> 
> s/Validation/Verification/
> 
> >    The exact level specification has not been determined yet, but the
> >    following has been suggested and seems to have consensus:
> >   
> >    a) Level 0: Verification is explicitly not included.  
> >   
> >    b) Level 1: The guru downloaded the sources from the primary upstream
> >       distribution site and verified they compiled and ran.
> >     
> >    c) Level 2: The guru verified the downloaded sources matched a hash
> >       published by the upstream authors.
> > 
> >    d) Level 3: The spell is using an upstream key which has been
> >       verified using at least one of the above listed methods.
> 
> This is probably redundant as worded, since if you get the key from any
> authoritative source, it "counts" as one verification method.  This is
> clearer:
> 
>      d) Level 3: The spell is using an upstream key obtained from the
>         primary upstream distribution site.
> 
> > 
> >    e) Level 4: The spell is using an upstream key that has been verified
> >       using three of the above listed methods.
> 
> Should we add:
> 
>      f) Level 5: The spell is using an upstream key that has been verified
>         in person via an official ID check.
> 
> for the Very Paranoid/ID Check Obsessed?



> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss


-- 
__________________________________________________________________________
|Andrew D. Stitt                           | astitt at sourcemage.org    |
|irc: afrayedknot                          | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus    | acedit at armory.com        |
|Sorcery Team Lead                         | ftp://t.armory.com/         |
--------------------------------------------------------------------------