Public SourceMage Discussion List

[Remko van der Vossen <wich AT yuugen.jp>]

On Thu, Dec 01, 2011 at 12:03:52AM -0500, Sukneet Basuta wrote:
> I don't think there is any argument against the fact that upstream
> signed sources are better than hashes.

There most certainly is an argument against that, which is that upstream
signatures are not under our control, whereas hashes (being part of the
grimoire) are. The difference is that with upstream signatures we have
no verification in place which would catch a compromised source archive
signed by a compromised signature. The grimoire only points to locations
outside our control for both the source archive as well as the
signature, which could easily be replaced by a third party, or even the
original developer who, for whichever reason decides to fsck with
everybody.

As flux mentioned, what we would like to have in the case of upstream
signatures is use the upstream signature and add a hashsum as well for
either the source archive or the signature. That way the source is
authenticated by the developer and verified by us, leaving no way for
anyone outside SMGL to compromise our users' systems indirectly by
compromising developers whose code we refer to in our grimoire.

Regards, Remko.