Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Ismael Luceno <ismael.luceno AT gmail.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Thu, 22 Dec 2011 22:43:39 -0200

On Thu, 22 Dec 2011 16:22:55 -0500
Sukneet Basuta <sukneet AT gmail.com> wrote:
> On Thu, Dec 22, 2011 at 3:15 PM, Ismael Luceno
> <ismael.luceno AT gmail.com> wrote:
> > I'm talking about something else. What I would like is to make
> > hashes mandatory for all downloaded files (thus handling upstream
> > signatures like any other file), but have them on a separate file,
> > so we can optionally sign it.
> >
> > The point to signing that file is the same as signing individual
> > files, to make it clear *who* verified it...
> >
>
> Isn't that exactly what signing a file does? Create a hash of the file
> and then encrypting that. I'm probably missing something, since you
> and flux obviously know a lot more about security than me.
>
> If the idea behind that is to ensure hashes are not comprised in the
> grimoire, I think a more broader scheme to verify the entire grimoire
> using git or something as flux suggested is a better idea. But, in
> that case, I think we are approaching OpenBSD level of paranoia. Not
> that this necessarily a bad thing.

Indeed, it would protect against a compromised server. And yes, we
could also implement some integration policy and achieve the same using
signed tags with git.

But my proposal is less strict, since a signed tag means "I approve
everything in this tree", whereas this only means you approve that
specific spell.

I don't claim it's the ultimate solution, and probably there are more
elegant ways to implement it.

Attachment: signature.asc
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page