Public SourceMage Discussion List

[Karsten Behrmann <BearPerson AT gmx.net>]

On Thu, 18 Aug 2005 09:21:53 -0700, Andrew wrote:
> Good point. Its also (potentially) a security risk, since if the key
> was described as ../../kernels/linux/foo.gpg, if the key wasnt found
> there (say it was renamed or moved) the code would look in the grimoire
> directory with that path appended to it. In that case it would look
> outside the grimoire into a possibly unsecured directory, the spell would
> use an incorrect gpg key and validate a possibly compromised source/sig.
> Unlikely, but worth mentioning.

Apropos security risks in gpg signing:
Just a thought, I'm almost sure it has to be resolved, but I thought I'd
mention it:
Do we specify a keyring as well as a signer's fingerprint or at least
ID?
Otherwise, couldn't the new gnu dev that just got into gnu.gpg sign off
a compromised binutils?
The basic point here is that maybe we should keep the keyrings as
collections to be referenced, but not as authorities on their own.

Feel free to send "we're doing that already"
so far,
  Karsten

Attachment: pgpgtrVLqeElg.pgp
Description: PGP signature