Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG keyring storage ?

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Karsten Behrmann <BearPerson AT gmx.net>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] GPG keyring storage ?
  • Date: Fri, 19 Aug 2005 01:08:01 +0200

On Thu, 18 Aug 2005 09:21:53 -0700, Andrew wrote:
> Good point. Its also (potentially) a security risk, since if the key
> was described as ../../kernels/linux/foo.gpg, if the key wasnt found
> there (say it was renamed or moved) the code would look in the grimoire
> directory with that path appended to it. In that case it would look
> outside the grimoire into a possibly unsecured directory, the spell would
> use an incorrect gpg key and validate a possibly compromised source/sig.
> Unlikely, but worth mentioning.

Apropos security risks in gpg signing:
Just a thought, I'm almost sure it has to be resolved, but I thought I'd
mention it:
Do we specify a keyring as well as a signer's fingerprint or at least
ID?
Otherwise, couldn't the new gnu dev that just got into gnu.gpg sign off
a compromised binutils?
The basic point here is that maybe we should keep the keyrings as
collections to be referenced, but not as authorities on their own.

Feel free to send "we're doing that already"
so far,
Karsten

Attachment: pgpgtrVLqeElg.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page