Public SourceMage Discussion List

[Thomas HOUSSIN <thomas.houssin AT gmail.com>]

Hi all, 


I agree with Sergey when he says : 

>
> So, I support use of GPG signatures, but for the correct
> purpose. Verifying integrity of the source tarballs is not a sufficient
> purpose.
>

Why do we want to check integrity with gpg ? Right
now, integrity of the sources is checked via MD5, and integrity and
authenticity of the spells/grimoires is done via gpg. This does nicely
what's
it's designed to do. We talked about
collisions. Even if it's possible to find collisions in a hash
function, because of the birthday paradox
(http://en.wikipedia.org/wiki/Birthday_paradox),
it does not mean that
you can alter the content and still have the same hash. However I do
not mean that we should stick to MD5, a stronger hash is IMHO a good
idea.





And even if gpg-signing the sources will only mean "these are the same
as the one the spell-creator downloaded", I do not like the idea. The first problem is it can be misleading:
when I download a source, and that it passes the signature
checking, I understand it like "there is no integrity problem" AND
"This comes from me, the developper" (or "according to the developers, as far as they know, there was no malicious
code added in it"). But here we'll only check the integrity. Another problem
is that we are already using gpg signature on the grimoires and on
sorcery with the "classic" meaning... Having another meaning when it comes
to the source will be misleading.

On 8/31/05, Ladislav Hagara <ladislav.hagara AT unob.cz> wrote:

> The beauty of hashes is that they don't need any extra support in
> addition to
> what's in sorcery now.


Moreover, if there is some integrity problem, even users can discuss
about their hashes, they can easily compare them.
In p4 reviews I see ascii changes, not only "binary file was changed".

Vendor signing is great but personally I would extra add our hash.
What about if for example home page of  wget is cracked, wget author's
key is stolen, new tarball with "rm -rf /*" is created and signed?
<snip>

Yep I like this idea. Why not always using a hash, and adding vendor signing when it's available ? 

Just my two cents...
Thomas

-- 
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36