Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Mon, 29 Aug 2005 16:24:08 -0400

Quoting David Kowis <dkowis AT shlrm.org>:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sergey A. Lipnevich wrote:
Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:


content. The three they list are authenticity, integrity, and
non-repudiation. Non-repudiation is the closest to the kind of single
meaning you're trying to attach to signing something, but again, a digital
signature only functions in that regard to establish that the signee was
the one that signed something. What the act of signing meant and what they


What you're saying is that signing something doesn't mean anything except that
it was signed by <person>. Why then your signature on a blank piece of paper
different from a signature on a contract?
I'm going to have to agree with Jeremy on this. A signature can be defined to mean anything the "contract" defines it to be. For example:

But you have to read this contract, not just say that there are no spelling
errors in it. Why do I feel like I'm bagning against the wall here? Why do I
never get a straight answer to the question "would you sign something you
didn't read?"

When I got a speeding ticket in the past, I had to sign it. It was not an admission of guilt, just an agreement to do something about the

Right, you accepted the responsibility. You'd be arrested if you refused to
sign.

ticket. And that's it. A gpg signature of the source tarball is perfectly acceptable, since we've defined our signature to verify that if

Acceptable, yes, thank you! But not mandatory.

There's no specific definition as to what a signature means. That's why you're told (at least, I was) to always read anything you've got to
sign so that you know what you're agreeing to when you sign it. We've

Exactly! And I can't read the source, there's too much of it. How can I sign it
then? If you can do that, please go ahead, but don't force me along this path.

(by we I mean the Sourcemage team) has made it quite clear that we're
not verifying that the source won't kill your mom, but that it's the same source we got when we built our spell.

Then don't use a signature.

I see nothing wrong with using gpg signatures for source verification.

Neither do I. I see a lot of things wrong with signing something I couldn't read
in advance. Did I say I don't aim to stop anyone from signing anything, I just
don't want to participate in this myself or see anyone else forced into it
against their will?

I think that one can never have enough security. especially when it

Signing something you didn't read can only take security away from you, not
provide more of it.

doesn't affect anything. There's a script under development, similar to
md5unpack to make gpg signing of source easy.

Right. What about a script that unbinds you from a signed contract in real life?
Did I ever say I don't want to do it because it's difficult? I don't think so.

Acutally the easiest way to send a file to someone would be to use GPG. Sign it and then the receiver simply verifies the signature.

If you have a verified key, yes. If your key is lost or stolen, no. Hashes don't
impose such limits.

like you just described are precisely what Public Key Infrastructure is for. Publishing a hash value on a widely known server is flawed. If

PKI and GPG are two very different things.
How is it "flawed" from the *integrity* point of view? I agree that it doesn't
provide *security*, I said that in item #1 of my original email.

that signature is compromised, how does one verify it? with another hash on another server? This can chain off into oblivion.
IMO, ISO publishers did this because gpg wasn't widely available.

Regardless of why they do it, it works: integrity can be verified and is
verified on a computer near you. No keys involved.

If it's my personal key, no. It doesn't matter what it says. If it's somehow
shared (I don't know if it's possible with GPG), than see my question above
about the plan to manage it.
Sub-keys of a master key. I think anyway. Your specific "Source signing key" would be signed by the master "SGML SOOPER SOURCE key".

I've contributed my sanity to this madness.
or is it my madness to this sanity...?

If we can agree on not making GPG signatures mandatory, we can stop right away.
I'm not interested in preaching on this subject, I just want my freedom of
choice back.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page