Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 31 Aug 2005, Sergey A. Lipnevich wrote:
> Quoting dave AT sourcemage.org:
<snip>
> > Your fellow devlopers are telling you the truth dude.
>
> What exactly do you mean? The part that the signature allows to check for
> authenticity of the package and the identity of the originator, established
> with Seth's help, I actually agree with. Hence my objection to being such an
> originator. Disclaiming authenticity and identity means that only integrity is
> left. And we agree I believe that integrity is adequately assured by hashes.
> Eric suggested stronger hashes. I agreed.

For clarification I was and am not agreeing that I think we should
stick with specific hashes for any reason, but was merely pointing out
that, if it is decided to keep SOURCE_HASH, that we should at least
use the same hash strength as that used by default, for now, of the
proposed replacement, GPG.

> Moreover, I am suggesting moving to an SCM system that has built-in commit
> signatures. If I'm not mistaken, Montone can do that, and Subversion with
> client certificates (not using PGP, but e-commerce style PKI).

We're currently looking at other SCMs and so far svk and bzr
(bazaar-ng) look the most promising, but both still fall short[0].

<snip>
> > The very idea that so
> > many of the primary developers of this project would be asking you to do
> > something grossly irresponsible, or worse, trying to trick you into it
> > with word games is adolescent and ridiculous. Look at the guys who are
>
> It is. To me it's ridiculuos too that I have to sign (assure authenticity and
> identify myself as originator of ) a package I didn't inspect under pressure
> from fellow developers.

That's because, IMO, you're refusing to see the light. We're not
saying you've inspected the package in any way other than what you're
currently doing with md5sums: download, cast, run. Worked? Yes, then
update. Didn't work? Find out why, fix if possible, update if it
works, otherwise WIP or ignore.

<snip>
> > the leadership of SMGL, or that your understanding of signatures might
> > have been a bit off.
>
> I understand signatures correctly. That's why I don't sign things blindly to
> begin with.

You're not signing it blindly, you're 'testing' the tarball the same
amount (see above) as you do with md5sums. We're just moving the
dependency on a specific has to a dependency on a program that
supports many hashes and has a team devoted to making sure the default
keys are 'safe'.
<snip>

- -sandalle

[0] http://www.sourcemage.org/node/1540

- --
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us                  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDFpu8HXt9dKjv3WERApfJAKCqVSgi15SROvsD62C+s2FK3fAfhgCfQLYX
5fuwB20odxaMeJ6thuZNPfs=
=C0UW
-----END PGP SIGNATURE-----