Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Tue, 30 Aug 2005 13:31:54 -0700

On Tue, Aug 30, 2005 at 04:15:58PM -0400, Sergey A. Lipnevich wrote:
> Quoting David Kowis <dkowis AT shlrm.org>:
>
> >>> definition of what a signature is for. You're the only one disagreeing
> >>> with us all on the definition of a signature. I've a strong feeling
> >>> that we're going to move forward with replacing the hashes with gnupg
> >>
> >>
> >> Is that the final consensus that hashes are not going to be supported?
> >>
> > I cannot speak for the entirety of the Source Mage community, but
> > I've no problems with it, and no one else has voiced disagreement.
>
> I believe it's time to answer that question. Who's authorized to seal the
> decision, sorcery lead or the project lead?

There's still time to discuss. Personally, I wouldn't be content with
removing a feature without consensus of all team leads that are effected
(sorcery, qa, grimoire, project are the ones I'm thinking of).

As I said, if you can show it's a common interpretation of signatures
that they mean something trascendental to what FIPS-186 denotes, I'm
willing to add support for spell signing directly to sorcery (which
creates a level of indirection that you should be content with). That
brings up the problem of increasing complexity of code and might lead to
a failure of users to trust the system due to its increased complexity.
So the "amount" of misunderstanding would have to be more than
proportional to the increased compexity that we would be adding. I'd
say it adds 10% complexity to the system if we add direct spell or
DETAILS signing. If you can show that this mistake is common enough to
warrant that increased complexity, I'll agree with you (on this matter
only).

Seth

P.S. It has come to my attention that a patch with what you would like
to see would go a long way toward improving your argument's viability.
Just something to consider at this juncture. I don't have time now to
code it since I'm assigned to work on the "signet" command that
automates guru signatures and proper key generation. But if you wanted
to, it might help, although bridges may have been charred too much for
that to hold any sway any longer.

P.P.S. Regarding charred bridges, I think next time you might tread
lighter responding to certain people, although it's really a mutual
suggestion -- I think others have not been as lightly treading as they
could have been as well, myself included.

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733

Attachment: pgpq8G4S4o_hI.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page