Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting Ladislav Hagara <ladislav.hagara AT unob.cz>:

> > So, I support use of GPG signatures, but for the correct
> > purpose. Verifying integrity of the source tarballs is not a sufficient
> > purpose.
>
> I agree with Sergey.

Thanks!

> Moreover, we shouldn't blindly trust vendors signing.
> Do we really know the developer of application XYZ is able to protect
> his key?
> Now if cracker gain access to application's web pages and to developer's
> key (yes it is possible) he can create new tarball with "rm -rf /*" and
> sorcery run it because sources are signed by developer. Cracker is not
> able to change our HASH (neither md5) in grimoire. Of course never say
> never. :-)

I think that as a good middle-man, the distribution should leave it to the
discretion of the user to [dis]trust package maintainers, and should make
executing any decision convenient. E.g., support for signatures is great, and
support for restricting casting to signed packages is great, but it's 
up to the
user to decide if something signed by authors is more secure. SMGL 
should remove
itself from this equation as much as possible.

If somebody were willing to start a "hardened" commercial distro based 
on SMGL,
they would use the features provided in sorcery and do extra work on verifying
package content, in exchange for money.

> And of course some changes should be approved by team not only
> "people who hang out there (not necessarily all stakeholders or
> interested parties), it was agreed ...".

I guess that's why we're having this discussion :-).

Sergey.