Public SourceMage Discussion List

[flux <flux AT sourcemage.org>]

Bor Kraljič (pyrobor AT ver.si) wrote [11.12.02 00:50]:
> GPG upstream vs GPG SMGL.
> 
> As stated in previous mail, the discussion about GPG upstream was on this 
> ML  
> not long ago [1]. But unfortunately we didn't come to any final conclusion. 
> The 
> best solutions was flux idea about adding hashsum for signatures. 
> 
> However I don't see the benefit in such solution. In Sorcery we have check 
> that 
> fails if any of the sources fail the verification. So adding hashsum for 
> signature would be pretty much the same as having hashsum for main source. 
> 
> The main question is: Will WE vouch for the sources or the UPSTREAM?
> a) WE. Then we should remove all upstream signatures and add hashsum or 
> developer signature.
> b) UPSTREAM. Use pure (without any hashsum of singatures) upstream 
> signatures 
> and fallback to using developers signature or hashsum if upstream 
> signatures 
> are not available. This is pretty much the way it is now described in our 
> Source Integrity Checking Standards [2].

You completely missed the points I've made in previous posts in this
thread. It is precisely not about us vs. them, but about single vs.
multiple points of failure. We already have (and have had for some time)
the choice of us vs. them, and it's been debated for a while. The points
I have raised (including the one you mention above) have nothing to do
with this dichotomy. You've also missed the point about compromised
upstream keys, which would result in tampered sources that do not fail
verfication (meaning sorcery will happily install tampered sources in
this case). My arguments/suggestions are concerned with providing
multiple points of failure/verification so that we don't rely on a
single source which, if compromised, would undermine all of the security
at once, whether that source was us or upstream. Having a SMGL hashed
upstream signature is one way to ensure that a compromised signature
will be seen as invalid by sorcery.

Regarding the us vs. them issue, IMHO upstream *should* always vouch for
their sources, but they don't always, so in those cases we do (this is
what's in the Source Integrity Checking Standards).

> SOURCE_HASH vs GPG SMGL.
> 
> I usually use the same method as it was previously used in spell. I try not 
> change the method. However that is only my practise and not a rule. 
> 
> Let me just say that I think it is pointless that we have 2 possibilities. 
> I 
> know we are all about choiceses. However here we don't benefit at all with 
> more 
> options. But only adding unnecessary confusion.
> 
> And if the Standards [2] are leaning towards GPG checking. Lets say the 
> future 
> has come and make all the spells that use HASH valid bugs. But I think that 
> is 
> decision of the lead developers. They should decide (after discussion with 
> developers of course) in which direction our distribution should be 
> going...  
> At this moment isn't going anywhere!

Although I think the issue here is still a little open, I think just
having one method for now is better as well. As I stated in my previous
post, unless a SMGL developer actually performs full security audits and
can truly guarantee the quality of a given spell (beyond simply the code
in the grimoire of the spell itself), I think signing a spell is
pointless and a hashsum would be better and simpler.

-- 
Justin "flux_control" Boffemmyer
Cauldron wizard and general mage
Source Mage GNU/Linux
http://www.sourcemage.org

Attachment: pgptY6fHfyNKn.pgp
Description: PGP signature