Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Mads Laursen <smgl AT dossen.dk>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Tue, 30 Aug 2005 00:27:12 +0200

On 29/08/05 16.31, Jeremy Blosser (emrys) wrote:
> On Aug 29, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
> > Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:
> >
> > > I'm sure most people are really tired of this thread before it even
> > > started, so I really want to bring my responses to a close. If you have
> > > things you think there is value in continuing to discuss, I'm willing to
> > > keep talking, but otherwise we should probably agree to end this soon
> > > and
> > > see if other project members have input.
> >
> > Just tell me signatures are not mandatory and it's over.
>
> That really is not my decision.

Hope nobody minds too much, that I join this thread.

Having read this discussion with some interest and skimmed the
suggested standard, I'd like to just make some observations:

- "Developers should not use their personal key for signing tarballs":
So it is not a matter of the developer signing the source with his
personal, trusted key, but with a seperate key, marked as such. My
view is that such a key could be view as the equivalent as a stamp
with "RECIEVED" or "APPROVED" that is used in a defined process.

- I seem to recall that gpg allows notations, that can provide a link
(cryptographically secure) between a signature and a document, that
describes the meaning and context of this signature. That document
could be the standard.

- Perhaps the specifics of the key could be specified in the standard?
It could for instance have a standard primary userid describing it's
purpose (note, that I'm not talking shared keys here, just multible
keys having the same describing userid). If easy identification of
the developer is needed, this could be handled either by a second
userid or via the comment and/or email fields of the primary userid.

- In keeping with the stamp idea, the keys could be signed by a master
key, according to a specific set of standards (to be defined), and
perhaps that key could also be given the ability to revoke the
"stamps"? That can be done using gpg, and would support the process,
and the defined intention of the signatures.

Anyway, just some things I came up with while reading. I truly hope I
do not offend anyone be adding my view.

And thanks to all who contribute to the great piece of software, that
handles all of my computing needs.

/dossen

Attachment: pgppuRicwn2Lm.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page