sm-discuss AT lists.ibiblio.org
Subject: Public SourceMage Discussion List
List archive
- From: Ismael Luceno <ismael.luceno AT gmail.com>
- To: sm-discuss AT lists.ibiblio.org
- Subject: Re: [SM-Discuss] GPG verification
- Date: Thu, 22 Dec 2011 22:43:39 -0200
On Thu, 22 Dec 2011 16:22:55 -0500
Sukneet Basuta <sukneet AT gmail.com> wrote:
> On Thu, Dec 22, 2011 at 3:15 PM, Ismael Luceno
> <ismael.luceno AT gmail.com> wrote:
> > I'm talking about something else. What I would like is to make
> > hashes mandatory for all downloaded files (thus handling upstream
> > signatures like any other file), but have them on a separate file,
> > so we can optionally sign it.
> >
> > The point to signing that file is the same as signing individual
> > files, to make it clear *who* verified it...
> >
>
> Isn't that exactly what signing a file does? Create a hash of the file
> and then encrypting that. I'm probably missing something, since you
> and flux obviously know a lot more about security than me.
>
> If the idea behind that is to ensure hashes are not comprised in the
> grimoire, I think a more broader scheme to verify the entire grimoire
> using git or something as flux suggested is a better idea. But, in
> that case, I think we are approaching OpenBSD level of paranoia. Not
> that this necessarily a bad thing.
Indeed, it would protect against a compromised server. And yes, we
could also implement some integration policy and achieve the same using
signed tags with git.
But my proposal is less strict, since a signed tag means "I approve
everything in this tree", whereas this only means you approve that
specific spell.
I don't claim it's the ultimate solution, and probably there are more
elegant ways to implement it.
Attachment:
signature.asc
Description: PGP signature
-
Re: [SM-Discuss] GPG verification
, (continued)
- Re: [SM-Discuss] GPG verification, David Kowis, 12/09/2011
- Re: [SM-Discuss] GPG verification, flux, 12/13/2011
- Re: [SM-Discuss] GPG verification, Sukneet Basuta, 12/13/2011
- Re: [SM-Discuss] GPG verification, flux, 12/17/2011
- Re: [SM-Discuss] GPG verification, Ismael Luceno, 12/12/2011
- Re: [SM-Discuss] GPG verification, flux, 12/13/2011
- Re: [SM-Discuss] GPG verification, Ismael Luceno, 12/22/2011
- Re: [SM-Discuss] GPG verification, Sukneet Basuta, 12/22/2011
- Re: [SM-Discuss] GPG verification, Ismael Luceno, 12/22/2011
- Re: [SM-Discuss] GPG verification, Sukneet Basuta, 12/22/2011
- Re: [SM-Discuss] GPG verification, Ismael Luceno, 12/22/2011
- Re: [SM-Discuss] GPG verification, Thomas Orgis, 12/23/2011
- [SM-Discuss] e-17 section, Robin Cook, 12/27/2011
- Re: [SM-Discuss] e-17 section, Thomas Orgis, 12/28/2011
- [SM-Discuss] new automake 1.11.2, Robin Cook, 12/28/2011
- Re: [SM-Discuss] GPG verification, David Kowis, 12/22/2011
Archive powered by MHonArc 2.6.24.