Public SourceMage Discussion List

[flux <flux AT sourcemage.org>]

I should add that my previous post was concerned with upstream signed
sources. If a source is signed by us, then the signature vs. the hashsum
are still not technically equivalent, but the signature will bear far
less weight, making the two practically equivalent (emphasis on
practically, as in "in practice").

<2cents>
For sources that are not signed by upstream, I personally prefer hashsum
only for the following reasons. 1) It's smaller, which for a single
spell doesn't matter much, but aggregately over the entire grimoire
would be a noticeable (though perhaps still small) difference in total
size. 2) It's faster to check a hashsum than a signature. 3)
Unless/until we do full security auditing of all spells we include in
the grimoire (akin to OpenBSD), having a developer self-sign an upstream
source results in an "authentication" of "it worked for me", which does
nothing to really guarantee the security of the source at all, meaning
that the added authenticability of a signature is basically meaningless.
If a given developer really takes the time and care to verify the
source, then that would be a different story, and in that case it may
then make sense for *that* developer to use signatures rather than
hashsums.
</2cents>

-- 
Justin "flux_control" Boffemmyer
Cauldron wizard and general mage
Source Mage GNU/Linux
http://www.sourcemage.org

Attachment: pgpWpluJm2mJz.pgp
Description: PGP signature