Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Ismael Luceno <ismael.luceno AT gmail.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Tue, 13 Dec 2011 01:13:37 -0200

On Sat, 03 Dec 2011 10:15:06 +0100
Bor Kraljič <pyrobor AT ver.si> wrote:
> I created wiki page [1] with *draft* for new standards. I copied the
> old standards, underlined parts that it would be a good idea to
> change (or at least discussed). For 2 out of 3 parts we already
> started the discussion.
>
> I also made few minor layout changes.
>
> I purpose that we make changes in this draft. And when we reach some
> kind of consense we vote on new standard according to our voting
> policy.

Signatures are inherently more complicated, and in the way we use them
don't add any extra security. Also, signing big files is expensive.

Signing is, if I understand correctly, just computing the hashes, and
encrypting the result of the set.

So if we just save the hashes separately and sign that file, it would
have a similar effect. We should also think about allowing several
signatures.

That, complemented with upstream signatures would make it a little more
difficult to tamper with. Given we find some way for users to validate
those keys independently of ours... (otherwise they would be merely a
convenience for devs to check what they download...)

That's it, my 2¢.

Attachment: signature.asc
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page