Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Mon, 29 Aug 2005 14:51:37 +0200


So, I support use of GPG signatures, but for the correct
purpose. Verifying integrity of the source tarballs is not a sufficient
purpose.


I agree with Sergey.
Moreover, we shouldn't blindly trust vendors signing.
Do we really know the developer of application XYZ is able to protect his key?
Now if cracker gain access to application's web pages and to developer's key (yes it is possible) he can create new tarball with "rm -rf /*" and sorcery run it because sources are signed by developer. Cracker is not able to change our HASH (neither md5) in grimoire. Of course never say never. :-)

And of course some changes should be approved by team not only
"people who hang out there (not necessarily all stakeholders or interested parties), it was agreed ...".

--
Got yourself a ledger.sourcemage.org account?
http://ledger.sourcemage.org/

Ladislav Hagara
Source Mage GNU/Linux Developer
http://www.sourcemage.org/








Archive powered by MHonArc 2.6.24.

Top of Page