Public SourceMage Discussion List

[seth AT swoolley.homeip.net]

On Mon, May 22, 2006 at 02:39:20AM +0200, Ladislav Hagara wrote:
> >
> >>> If upstream changes the tarball on us we should always check what 
> >>> changed
> >>> to be sure it's benign; if we see it's a bugfix we should probably
> >>> increment PATCHLEVEL when we fix the hash.
> >> I used to be the main one reporting modified tarballs and auditing them,
> >> which I did for two years until the cheap disk drive crashed.
> >>
> >> I still have scripts I did to automate the audit weekly. Shall I set
> >> them up again? It would be cool to integrate that into pm-seer so
> >> everybody running prometheus would get a security-optimized (includes
> >> file attributes from the tar and operates on binaries) diff output
> >> as an attachment to the bug when the checksum failed.
> > That would be great.
> > Right now we don't always have a source tarball with the old hash, so
> > can't always compare. The above change had a diff attached to the bug,
> > but in many cases we have to ask upstream if the current tarball is
> > valid.
> 
> And what about "Vendor Signed Spells"?
> We are not able to find out we use different sources. :-(

summon -d fixes this issue, but it can be made to be automatically 
retried on a vendor-signed source if you file a bug and assign it to me.


In fact, summon -d could detect that a certain source is a signature of 
another spell and force redownload the signature on every summon, where 
if it detected a difference it could resummon the original source that 
it intends to sign.  This allows websites to update an upstream source 
gracefully.  If the PGP process is compromised _it is and always will be 
out of our hands_ unless you know of another suggestion.

(configured as an optional feature in the sorcery menu, too, so you can 
still get the older more paranoid behavior.)

Also, as has been said before, you can include the vendor's signature 
locally in the spell if you are worried about the security of a vendor 
signature.  If you are so concerned you can sign it yourself or hash it 
yourself if you are the guru.  You can also set your own verification 
settings in sorcery to not accept vendor signatures if you so desire, if 
you are the end user.

We allow so many ways to verify things, can you be happy with what 
you've got?