Public SourceMage Discussion List

[David Kowis <dkowis AT shlrm.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sergey A. Lipnevich wrote:
> Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:
> 
> 
>>content.  The three they list are authenticity, integrity, and
>>non-repudiation.  Non-repudiation is the closest to the kind of single
>>meaning you're trying to attach to signing something, but again, a digital
>>signature only functions in that regard to establish that the signee was
>>the one that signed something.  What the act of signing meant and what they
> 
> 
> What you're saying is that signing something doesn't mean anything except 
> that
> it was signed by <person>. Why then your signature on a blank piece of paper
> different from a signature on a contract?
I'm going to have to agree with Jeremy on this. A signature can be defined to 
mean anything the "contract" defines it to be. For example:
When I got a speeding ticket in the past, I had to sign it. It was not an 
admission of guilt, just an agreement to do something about the
ticket. And that's it. A gpg signature of the source tarball is perfectly 
acceptable, since we've defined our signature to verify that if
the signature's good, then you got the exact same source that the spell 
writer used when he/she/it developed the spell.

> 
> 
>>>>>Please read my original item #4. Using Jeremy's analogy, signing an email
>>>>
>>>>Again, I wasn't making an analogy, I was making a point that 
>>>signatures can
>>>>mean more than one thing, and people are used to this.
>>>I'm sorry, but your point is invalid in my eyes, for the reason I 
>>>have stated
>>>multiple times.
>>
>>Yes, it's clear you know what you think and aren't interested in changing
>>your opinion.  However, established practice and definitions are not in
>>line with that opinion, so please don't expect we'll agree with it.  As I
> 
> 
> We're claiming the same thing here :-), that there's an "opinion" and
> "definitions" regarding signatures. Only I claim that they are rigid and you
> claim they're flexible.
There's no specific definition as to what a signature means. That's why 
you're told (at least, I was) to always read anything you've got to
sign so that you know what you're agreeing to when you sign it. We've (by we 
I mean the Sourcemage team) has made it quite clear that we're
not verifying that the source won't kill your mom, but that it's the same 
source we got when we built our spell.

> 
> In regards to others disagreeing with me, I see only you for now. 
I see nothing wrong with using gpg signatures for source verification.

>Anyway, I
> don't ask you or anyone else to agree, I am simply saying that non-author
> signatures are too much. I'm happy with a status quo right now: I and others
> who don't want to sign 3rd party packages can use SHA1 hashes to allow 
> users to
> verify integrity of tarballs. Simply don't force me to accept your point of
> view, as I am not forcing you to accept mine. Both can coexist and actually 
> do
> coexist right now. I am requesting not to change that.
> 
I think that one can never have enough security. especially when it doesn't 
affect anything. There's a script under development, similar to
md5unpack to make gpg signing of source easy.
> 
>>noted before, even our own grimoire and sorcery tarball signatures fit this
>>broader model.  The primary use and meaning of a cryptographic signature is
>>in point of fact transmission integrity verification.  Non-repudiation is a
> 
> 
> Sorry, but this is not true. Use a differerent channel to pass a hash 
> value for
> your content and you'll achieve the same purpose: integrity is verified. If 
> I
> have to send a file to you, the easiest way to check integrity would be 
> to send
> the file by email and either send hash with it or send hash via ICQ for
> instance. Or publish this hash value on a widely known server and allow 
> copying
> it everywhere, like ISO publishers usually do. In all cases, integrity means
> that the file is not altered in transmission. Signature claims something *in
> addition* to that.
Acutally the easiest way to send a file to someone would be to use GPG. Sign 
it and then the receiver simply verifies the signature. Things
like you just described are precisely what Public Key Infrastructure is for. 
Publishing a hash value on a widely known server is flawed. If
that signature is compromised, how does one verify it? with another hash on 
another server? This can chain off into oblivion.
IMO, ISO publishers did this because gpg wasn't widely available.
> 
> 
>>>>>So, I would agree to sign the *spell* that I altered, but not the
>>>>>*source* coming from a 3rd party web site.
>>>>
>>>>I ask again, would it make you feel any better to use a key that did not
>>>>have your name on it, but instead had a name indicating it was a source
>>>>integrity verification key only.
>>>
>>>If you have a good plan for managing such a key so that developers cannot
>>>willingly or unwillingly frame each other, I'd like to hear it.
>>
>>I wasn't suggesting a common key, I was suggesting individual keys that
>>would make it completely clear that it isn't "Sergey's key", it's "a
>>distribution download integrity verification key".
> 
> 
> If it's my personal key, no. It doesn't matter what it says. If it's somehow
> shared (I don't know if it's possible with GPG), than see my question above
> about the plan to manage it.
Sub-keys of a master key. I think anyway. Your specific "Source signing key" 
would be signed by the master "SGML SOOPER SOURCE key".

I've contributed my sanity to this madness.
or is it my madness to this sanity...?

- --
David Kowis

ISO Team Lead - www.sourcemage.org
SourceMage GNU/Linux

Progress isn't made by early risers. It's made by lazy men trying to find 
easier ways to do something.
  - Robert Heinlein

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)

iD8DBQFDE2mvtgErhgxHMHsRAnf5AJ42hdROTUAjU+kWEUiLJ5gIra+WDACggOzL
sJ5UxtFX9jErhpbiOlzhPjI=
=hQPu
-----END PGP SIGNATURE-----