Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting Eric Sandall <eric AT sandall.us>:

> We're not asking you to sign your soul away. I cannot see how you are
> completely missing the point of what we're saying. You are /not/
> signing tarballs saying that you have audited the code (unless you
> have, then you can say that), nor that you guarantee this tarball
> won't break your computer, nor that this tarball has no viruses,
> trojans, worms, wife beaters, etc. in it, nor that this tarball has no
> bugs, nor many other things. The only thing the GPG signatures are for
> is to replace the dependency on specific hashsums (md5sum, sha1sum,
> etc.) and to allow for trusting the vendor's as much as we currently
> trust them (I don't recall anyone doing audits of source code of any
> packages for SMGL and no one complained that signing (yes, it's
> technically a signature) with the md5sum said that you had done that).

Let me explain it differently because we keep walking around the same 
issue. The
users don't care no matter how you describe your use of signatures. I 
as a user
don't care how for example Apache Software Foundation describes their use of
signatures. When I, as a user, see a signature, I assume that they vouch for
contents of file, not just this file's integrity. That's how I treat
signatures. Tell me if I'm wrong, but you better have a good reason for it.
Maybe I as a user can go and read the authors' key policy, but ususally I'd do
that only when the actual problem comes up that prompts me to do so.

Even more so, Apache for example doesn't have any explanation. I tried 
searching
the site and I can't find a policy. Please find me a policy on some major OSS
vendor site that says: GPG signatures are used for integrity only and do *not*
mean non-repudiation and authenticity *of the code*. This file for 
example says
"signatures are used for code signing:"

http://svn.apache.org/repos/asf/lenya/trunk/KEYS

Did I make myself clear on why I don't care about what's written on our 
Web site
about signatures, and nobody else does? I hope I did. Please understand that
*this* point is the beef of my argument. I tried to express it as item 
#4 of my
original email, which was not understood well.

Now, as a maintainer, I am worried about perceived meaning of signatures. I do
not want my users to have a false feeling of security because the tarball is
signed. Moreover, I am not taking the responsibility of signing things I don't
read, even though you try to tell me that we have a disclaimer. With or 
without
this disclaimer, I can't do that.

Finally, I'm saying, and we agree on that at least with you Eric, that hash
values do allow for detection of integrity problems. I argue that they are
sufficient, and there's no reason to go further. If package authors sign their
packages, we support GPG verification, otherwise all bets are off. But please
understand that this is just a secondary reason of why I can't sign a tarball.
If there were no such thing as hash value, I couldn't sign an alien tarball
anyway.

Finally, Seth here is telling us that signatures do not mean security.
Regardless of whether I agree or disagree with this, please understand that
signatures are perceived as means to provide additional layer of... what?
correct, *security*! Why do I think so? Let me put our friend Andrew on the
spot (I'm sorry Andrew, you made it too easy with your email to make my 
point).
He recently wrote this:
https://lists.ibiblio.org/sympa/arc/sm-discuss/2005-August/011907.html

Citing it: "This is part of my new security policy I'm implementing for 
myself.
This key expires end of the year and I will issue a new one then."

So, people do perceive digital keys as a means of security. Not the 
only means,
of course, but definitely an important one. In the U.S., you can sign 
your name
now with the help of digital signature. Not GPG I think. Nevertheless, in the
public eye digital signature is very much alike the real deal. You can't try
and change this meaning just by posting a disclaimer on the site.

The question is, are we clear now on what I am objecting to?

Sergey.