Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Remko van der Vossen <wich AT yuugen.jp>
  • To: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Fri, 2 Dec 2011 08:47:12 +0900

On Fri, Dec 02, 2011 at 02:02:29AM +0900, flux wrote:
> You completely missed the points I've made in previous posts in this
> thread. It is precisely not about us vs. them, but about single vs.
> multiple points of failure.

Note that using upstream gpg with signature hashes still does not remove
the single point of failure, we only move it, or actually reduce the
number of single points of failure from two to one. If the grimoire is
compromised the pgp key in the grimoire could simply be replaced by
another key, the key url can be changed and the signature hash can be
changed, still a single point of failure. If we really want to remove
the single point of failure we need to take part of the equation out of
the grimoire.

What we could do is require that upstream keys are signed by SMGL owned
keys, this could either be with some single SMGL authority key, or with
a web of trust kind of deal where a certain number of gurus need to have
signed the key. If we go this route however we should be very careful
with how people use their keys etc. Right now a number of people,
including myself use or used their regular gpg key for source signing in
the grimoire. If we start signing other keys with our keys we can't use
our normal keys anymore as that would invalidate the normal worldwide
web of trust since we don't actually do any identity check for those
keys with the owners. Note that of course the authority key and/or the
list of guru keys needs to external to the grimoire, preferably external
to SMGL itself, i.e. people should need to put the keys into a keyring
themselves or whichever. Should we just put it up on the SMGL server the
server just becomes the signle point of failure.

In my opinion the difference between source hash and upstream gpg with
siganture hash is that in the latter case we have the ensurance that, as
long as the key is not compromised, the source we are dealing with
actually came from the developer, or was at least verified by the
developer, and isn't just something put up by any random joe. Both cases
however guard against sources being changes/corrupted/compromised under
our noses without us nowing about it, which would be a worry if we use
upstream siganture only and the upstream key would get compromised.

Regards, Remko.

Attachment: pgp0yzUO1s6k_.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page