Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 29 Aug 2005, Sergey A. Lipnevich wrote:
> Hi All,
>
> I can think of the following compromise that would hopefully satisfy all 
> sides.
>
> 1. Sorcery keeps support for hashes and signatures, both optional, but with
> possibility to be restricted by users of individual systems. Here's one for 
> the
> choice.
>
> 2. When this option becomes available, we move to digitally sign every
> repository commit. In effect, this will also sign a hash that is stored in
> DETAILS. Should a tarball or both tarball and hash value become compromised,
> our repository will help detect that. For added protection, we can also 
> include
> the size of tarball into DETAILS, effectively signing it as well.
>
> This way, we will do exactly what is claimed on that Web page: sign package
> receipt without signing the contents.
>
> How does appeal to everyone?

If we do go for allowing hashsums we'll want to make sure they're as
close to being as good as the GPG signatures, which use sha512 at the
moment. So all hashsums would have to be done with sha512.

- -sandalle

- --
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us                  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDFJxsHXt9dKjv3WERAkIRAJ4zg5nDABLUbbpCWJ/QuodF6FcnpACfbaKR
1bt2RDjed4xP13hYGYOwq0w=
=sEQE
-----END PGP SIGNATURE-----