Public SourceMage Discussion List

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

On Wed, Aug 31, 2005 at 06:40:44PM -0400, Sergey A. Lipnevich wrote:
> On Wed, 2005-08-31 at 09:27 -0700, Andrew wrote:
> 
> > tarball then, publish the grimoire, its the same thing, the old bad
> > signature isn't in any accesible grimoire, no more than the bad hash
> > would be. The problem that key revocation solves is to protect un-updated
> > grimoires already in the field, where either the hash, or the signature
> > have been compromised. Hashes alone do not solve this problem. If cast can
> 
> Well, I believe they solve it sufficiently well actually: having an
> Internet connection is all it takes. You download a new grimoire tarball
> which you have to do anyway to get a new hash/signature. But in
> signatures case, there's an added step of contacting key server for
> every key and making sure it's not revoked. Remember also that the key
> revocation makes all signatures by this key invalid. So *all* signatures
> by the developer who signed the malicious tarball, have to be detected
> and deleted.

There is no keyserver, guru signing keys are not published to any
keyserver unless the guru wants to, but theres no point to it, the keys
are taken from the gurus.gpg keyring included in the grimoire.

-Andrew


-- 
__________________________________________________________________________
|Andrew D. Stitt                           | astitt at sourcemage.org    |
|irc: afrayedknot                          | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus    | acedit at armory.com        |
|Sorcery Team Lead                         | ftp://t.armory.com/         |
--------------------------------------------------------------------------