Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

I know a lot of this conversation died down last week while I was away, and
I'm not necessarily looking to stir it up again, but I did want to post one
more possible compromise.

For those who are uncomfortable with the idea of signing an upstream
tarball (for whatever reason), how would you feel about the following:

- You could continue to use SOURCE_HASH in DETAILS as you do now, with
  sha256 as the minimum as previously discussed.

- A script on our p4 server would periodically be run to check for any
  spells using SOURCE_HASH in DETAILS and automatically replace them with
  signatures.  The script would generate these signatures using a key
  created for this purpose, eg "SMGL automated tarball verification signing
  key".  It would download the upstream tarball, verify the hash was the
  same as the guru said it was, and then sign.  It would possibly add a
  line to HISTORY indicating it modified DETAILS.

- This script would be run at such a time that spells would always be
  switched to SOURCE_GPG before the grimoire tarballs were generated.

This achieves the following:

- Sorcery no longer has to support SOURCE_HASH, since spells using this are
  modified before sorcery sees them.  From their perspective everything is
  handled in GPG, which is what they want.

- People who don't want to don't have to sign upstream tarballs, at all.
  You just have to continue to provide a valid SOURCE_HASH like you do now.
  Your name isn't associated with the tarball beyond anything you've got in
  the HISTORY file for that spell, just like it is now.  I think this is
  what you want?

As far as I'm concerned we don't need to discuss this particular option
here to death or at all, I'm just curious if it would change the informal
poll results.  I'm aware it is not a perfect solution, but nothing is.  The
biggest potential issue I see with it is that it means an automated process
is doing GPG signing, and this could potentially be compromised.  However,
anyone with the access to the p4 server to compromise this script could
also just modify any hashes inside the DETAILS file, and we'd never know it
since hashes do not provide authentication or other methods to protect
against in-transit modification.

So the question is, would this resolve things for people?  More
specifically, would anyone that responded to sandalle's poll indicating
that they would not be willing to sign upstream tarballs be willing to use
this option?  Please feel free to reply to sandalle privately if you don't
want to answer publically.

Attachment: pgpWc2xIbjbJB.pgp
Description: PGP signature