Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Sukneet Basuta <sukneet AT gmail.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Thu, 22 Dec 2011 16:22:55 -0500

On Thu, Dec 22, 2011 at 3:15 PM, Ismael Luceno <ismael.luceno AT gmail.com>
wrote:
> I'm talking about something else. What I would like is to make hashes
> mandatory for all downloaded files (thus handling upstream signatures
> like any other file), but have them on a separate file, so we can
> optionally sign it.
>
> The point to signing that file is the same as signing individual
> files, to make it clear *who* verified it...
>

Isn't that exactly what signing a file does? Create a hash of the file
and then encrypting that. I'm probably missing something, since you
and flux obviously know a lot more about security than me.

If the idea behind that is to ensure hashes are not comprised in the
grimoire, I think a more broader scheme to verify the entire grimoire
using git or something as flux suggested is a better idea. But, in
that case, I think we are approaching OpenBSD level of paranoia. Not
that this necessarily a bad thing.




Archive powered by MHonArc 2.6.24.

Top of Page