Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting David Kowis <dkowis AT shlrm.org>:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Sergey A. Lipnevich wrote:
> > Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:
> >
> >
> > > content.  The three they list are authenticity, integrity, and
> > > non-repudiation.  Non-repudiation is the closest to the kind of single
> > > meaning you're trying to attach to signing something, but again, a digital
> > > signature only functions in that regard to establish that the signee was
> > > the one that signed something.  What the act of signing meant and what they
> >
> >
> > What you're saying is that signing something doesn't mean anything 
> > except that
> > it was signed by <person>. Why then your signature on a blank piece of paper
> > different from a signature on a contract?
> I'm going to have to agree with Jeremy on this. A signature can be 
> defined to mean anything the "contract" defines it to be. For example:

But you have to read this contract, not just say that there are no spelling
errors in it. Why do I feel like I'm bagning against the wall here? Why do I
never get a straight answer to the question "would you sign something you
didn't read?"

> When I got a speeding ticket in the past, I had to sign it. It was 
> not an admission of guilt, just an agreement to do something about the

Right, you accepted the responsibility. You'd be arrested if you refused to
sign.

> ticket. And that's it. A gpg signature of the source tarball is 
> perfectly acceptable, since we've defined our signature to verify 
> that if

Acceptable, yes, thank you! But not mandatory.

> There's no specific definition as to what a signature means. That's 
> why you're told (at least, I was) to always read anything you've got 
> to
> sign so that you know what you're agreeing to when you sign it. We've

Exactly! And I can't read the source, there's too much of it. How can I 
sign it
then? If you can do that, please go ahead, but don't force me along this path.

> (by we I mean the Sourcemage team) has made it quite clear that we're
> not verifying that the source won't kill your mom, but that it's the 
> same source we got when we built our spell.

Then don't use a signature.

> I see nothing wrong with using gpg signatures for source verification.

Neither do I. I see a lot of things wrong with signing something I 
couldn't read
in advance. Did I say I don't aim to stop anyone from signing anything, I just
don't want to participate in this myself or see anyone else forced into it
against their will?

> I think that one can never have enough security. especially when it

Signing something you didn't read can only take security away from you, not
provide more of it.

> doesn't affect anything. There's a script under development, similar to
> md5unpack to make gpg signing of source easy.

Right. What about a script that unbinds you from a signed contract in 
real life?
Did I ever say I don't want to do it because it's difficult? I don't think so.

> Acutally the easiest way to send a file to someone would be to use 
> GPG. Sign it and then the receiver simply verifies the signature.

If you have a verified key, yes. If your key is lost or stolen, no. 
Hashes don't
impose such limits.

> like you just described are precisely what Public Key Infrastructure 
> is for. Publishing a hash value on a widely known server is flawed. If

PKI and GPG are two very different things.
How is it "flawed" from the *integrity* point of view? I agree that it doesn't
provide *security*, I said that in item #1 of my original email.

> that signature is compromised, how does one verify it? with another 
> hash on another server? This can chain off into oblivion.
> IMO, ISO publishers did this because gpg wasn't widely available.

Regardless of why they do it, it works: integrity can be verified and is
verified on a computer near you. No keys involved.

> > If it's my personal key, no. It doesn't matter what it says. If it's somehow
> > shared (I don't know if it's possible with GPG), than see my question above
> > about the plan to manage it.
> Sub-keys of a master key. I think anyway. Your specific "Source 
> signing key" would be signed by the master "SGML SOOPER SOURCE key".
>
> I've contributed my sanity to this madness.
> or is it my madness to this sanity...?

If we can agree on not making GPG signatures mandatory, we can stop 
right away.
I'm not interested in preaching on this subject, I just want my freedom of
choice back.

Sergey.