Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Remko van der Vossen <wich AT yuugen.jp>
  • To: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Fri, 2 Dec 2011 08:23:14 +0900

On Thu, Dec 01, 2011 at 11:46:15PM +0900, flux wrote:
> The problem isn't really about upstream vs. SMGL-local, but rather about
> having a single point of failure. Having multiple locations from which
> to verify the same source (upstream signature plus "local" hash of the
> signature is one example/possibility) improves the system by shielding
> against the single point of failure problem.

Just to be clear, I wasn't talking local vs upstream, I was saying
foregoing a local check for upstream only is a bad idea. I am very much
in favor of using upstream gpg when it is available, but we should also
have a local check in my opinion to ensure that a compromised gpg key
which is outside of our control cannot impact our users.

And yes, naturally, if our grimoire gets compromised we are pretty much
just fscked, but I assumed that went without saying.

Regards, Remko.

P.S. sorry if an empty mail reached you as well, I was still trying to
wake up...

Attachment: pgp36MOoaKV2Y.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page