Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Thomas Orgis <thomas-forum AT orgis.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Fri, 23 Dec 2011 09:32:16 +0100

Am Thu, 22 Dec 2011 22:43:39 -0200
schrieb Ismael Luceno <ismael.luceno AT gmail.com>:

> But my proposal is less strict, since a signed tag means "I approve
> everything in this tree", whereas this only means you approve that
> specific spell.

Are we talking about signing the whole spell? If we are talking about
compromised grimoires, those scripts running as root are a nice attack
vector. Manipulated sources and hashes are a minor concern subsumed in
that. If we trust the grimoire, just hashing every upstream source
should be fine. If not, we should implement a lot more of paranoia.

In absence of that paranoia I think it is just a good idea to hash
upstream sources in any case and have the upstream signature as an
additional layer of verification. After all, we do want to know if an
upstream file changed, even if legitimally (as we know they do).
Hashing the signature might make sense for a case where there is an old
version of the sig in sorcery spool which would fail to verify a newer
source file (the spell has been adapted to that change). If there is a
sig hash, sorcery can decide to delete the outdated sig and summon the
current one.

That aside... I would be more comfortable if a signed tag meant
only me signing the changes I commit, not the whole tree.


Alrighty then,

Thomas.

PS: As I noted on IRC, in any case, I do feel that specification of
sources / hashes / signatures in DETAILS could be less crufty.
Especially having to name the signature file multiple times and setting
SOURCE2_IGNORE. Some special casing that caters for the common
case of signatures having the same URLs as sources, just with .sig
or .asc appended, would be helpful.

Attachment: signature.asc
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page