Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 29 Aug 2005, Sergey A. Lipnevich wrote:
> Quoting Seth Alan Woolley <seth AT positivism.org>:
>
> > DRAFT, although this is one case where we're actually moving on it
> > quickly, so it's more of a last call for objections.
>
> So here goes: I object.
>
> 1. Hash collision is not a problem when it comes to source tarballs, so please
> don't use it as a reason to switch to signatures. We could've as easily hashed
> them with CRC32 or with 10K-bit hash. *Either* way provides *no* security.

Care to explain? The nice part about GPG is that we can change
hashsums without changing which tool (GPG) we're using.

> 2. There's no way I can sign a bunch of code I didn't read through and
> understand. It's an impossible task in a distribution, so it's shorter to say
> that I can't sign a bunch of code, period.

You must have forgotten to read the prior conversations. We are /not/
guaranteeing that these files are trojan/virus/malware/whatever-free.
What we are guaranteeing is that the tarball the user downloaded is
the same as the one the guru tested with. Nothing less, nothing more.

> 3. Let's be frank Seth, tarballs that you, or anyone else besides the authors,
> signed are as *insecure* as they were before you did that. It didn't format
> your hard drive? Good for you. Maybe it's designed to format only *mine*. Or
> the drive of the guy who works for CIA ot Chinese government. You don't know
> that.

We have that problem now. Your point?

> 4. Combination of #2 and #3 leads me to believe that we do not provide *any*
> additional security over unsigned tarballs, so let's focus on *integrity*.
> Integrity is *perfectly* verified by the hash. Stronger hash if necessary, but
> nevertheless a hash. Non-personified piece of information.
> 5. What people keep saying on the list amounts to: let's call it blue even
> though it's black. Meaning, let's call GPG signature a means to verify
> integrity even though it's a means to verify source and integrity. I don't buy
> that.
>
> Don't get me wrong, I believe that PGP and GPG are one of the most overlooked
> technologies of the present time, in the light of PKI having so many
> unresolved
> and abandoned issues. So, I support use of GPG signatures, but for the correct
> purpose. Verifying integrity of the source tarballs is not a sufficient
> purpose.
>
> Sergey.

You seem to have missed the entire conversation. That's exactly what
we've been saying the entire time and we've corrected people who
posted misunderstandings: GPG is being used to verify the tarball is
what the guru used, nothing more, nothing less.

- -sandalle

- --
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us                  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDEy4JHXt9dKjv3WERAlaoAJ0SBmA89XQpQqHAck57os+avaWgAQCfXICx
8PIDKkQLReZrciSi0syqALk=
=/vdm
-----END PGP SIGNATURE-----