Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Summary of GPG Discussions / For Real Proposal

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Andrew <afrayedknot AT thefrayedknot.armory.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Summary of GPG Discussions / For Real Proposal
  • Date: Wed, 17 Aug 2005 17:11:02 -0700

Thanks for putting this together. I filed a bug to add support for the
verification level field to sorcery.

-Andrew

On Wed, Aug 17, 2005 at 01:54:26PM -0500, Jeremy Blosser (emrys) wrote:
> Here I go replying to myself again...
>
> On Aug 17, Jeremy Blosser (emrys) [jblosser-smgl AT firinn.org] wrote:
> > 3) Upstream keys are always preferred, since they maintain a complete
> > validation chain of the source and require the least ongoing
> > maintenance for gurus. However, before including an upstream key in
> > the grimoire(s), gurus should attempt to verify the key at least
> > three of the following ways:
> >
> > a) Get the key/fingerprint from the primary distribution site for the
> > package in question.
> >
> > b) Get the key from one of the public keyservers (either pgp.mit.edu
> > or subkeys.pgp.net).
> >
> > c) Get the key/fingerprint from an official post to a mailing list
> > for the package in question.
> >
> > d) Have a version of the key that is signed by a key we already
> > include and have three-method verification for.
>
> I forgot:
>
> e) Confirm the fingerprint via private email/mail/IRC chat/phone/etc.
> with the upstream key owner.
>
> Are there more?
>
> > "Validation" means that the fingerprint retrieved in the above method
>
> s/Validation/Verification/
>
> > The exact level specification has not been determined yet, but the
> > following has been suggested and seems to have consensus:
> >
> > a) Level 0: Verification is explicitly not included.
> >
> > b) Level 1: The guru downloaded the sources from the primary upstream
> > distribution site and verified they compiled and ran.
> >
> > c) Level 2: The guru verified the downloaded sources matched a hash
> > published by the upstream authors.
> >
> > d) Level 3: The spell is using an upstream key which has been
> > verified using at least one of the above listed methods.
>
> This is probably redundant as worded, since if you get the key from any
> authoritative source, it "counts" as one verification method. This is
> clearer:
>
> d) Level 3: The spell is using an upstream key obtained from the
> primary upstream distribution site.
>
> >
> > e) Level 4: The spell is using an upstream key that has been verified
> > using three of the above listed methods.
>
> Should we add:
>
> f) Level 5: The spell is using an upstream key that has been verified
> in person via an official ID check.
>
> for the Very Paranoid/ID Check Obsessed?



> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss


--
__________________________________________________________________________
|Andrew D. Stitt | astitt at sourcemage.org |
|irc: afrayedknot | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus | acedit at armory.com |
|Sorcery Team Lead | ftp://t.armory.com/ |
--------------------------------------------------------------------------




Archive powered by MHonArc 2.6.24.

Top of Page