Skip to Content.
Sympa Menu

sm-discuss - [SM-Discuss] another possible compromise on the GPG question

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: [SM-Discuss] another possible compromise on the GPG question
  • Date: Mon, 12 Sep 2005 16:22:32 -0500

I know a lot of this conversation died down last week while I was away, and
I'm not necessarily looking to stir it up again, but I did want to post one
more possible compromise.

For those who are uncomfortable with the idea of signing an upstream
tarball (for whatever reason), how would you feel about the following:

- You could continue to use SOURCE_HASH in DETAILS as you do now, with
sha256 as the minimum as previously discussed.

- A script on our p4 server would periodically be run to check for any
spells using SOURCE_HASH in DETAILS and automatically replace them with
signatures. The script would generate these signatures using a key
created for this purpose, eg "SMGL automated tarball verification signing
key". It would download the upstream tarball, verify the hash was the
same as the guru said it was, and then sign. It would possibly add a
line to HISTORY indicating it modified DETAILS.

- This script would be run at such a time that spells would always be
switched to SOURCE_GPG before the grimoire tarballs were generated.

This achieves the following:

- Sorcery no longer has to support SOURCE_HASH, since spells using this are
modified before sorcery sees them. From their perspective everything is
handled in GPG, which is what they want.

- People who don't want to don't have to sign upstream tarballs, at all.
You just have to continue to provide a valid SOURCE_HASH like you do now.
Your name isn't associated with the tarball beyond anything you've got in
the HISTORY file for that spell, just like it is now. I think this is
what you want?

As far as I'm concerned we don't need to discuss this particular option
here to death or at all, I'm just curious if it would change the informal
poll results. I'm aware it is not a perfect solution, but nothing is. The
biggest potential issue I see with it is that it means an automated process
is doing GPG signing, and this could potentially be compromised. However,
anyone with the access to the p4 server to compromise this script could
also just modify any hashes inside the DETAILS file, and we'd never know it
since hashes do not provide authentication or other methods to protect
against in-transit modification.

So the question is, would this resolve things for people? More
specifically, would anyone that responded to sandalle's poll indicating
that they would not be willing to sign upstream tarballs be willing to use
this option? Please feel free to reply to sandalle privately if you don't
want to answer publically.

Attachment: pgpWc2xIbjbJB.pgp
Description: PGP signature



  • [SM-Discuss] another possible compromise on the GPG question, Jeremy Blosser (emrys), 09/12/2005

Archive powered by MHonArc 2.6.24.

Top of Page