sm-discuss AT lists.ibiblio.org
Subject: Public SourceMage Discussion List
List archive
Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.
- From: Thomas Orgis <thomas-forum AT orgis.org>
- To: sm-discuss AT lists.ibiblio.org
- Subject: Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.
- Date: Fri, 28 Feb 2020 16:14:01 +0100
Am Thu, 27 Feb 2020 11:06:15 +0100
schrieb Thomas Orgis <thomas-forum AT orgis.org>:
> Upstream signatures are there for the guru to verify and establish trust
For that purpose, I'd really like the gpg files from the grimoire to be
moved to a spell (the files themselves moved into an archive to be
summoned) which installs something like /usr/share/upstream-keys/*.gpg .
That way, they're actually more easy to use for interactive
verification, with a known location, and we get rid of the binary blobs
in the grimoire itself. That's 425 files with about 4M size total.
The're a bit compressible, so the net effect on grimoire.tar.bz2 is
from 13M to 10M if we leave them out.
Thinking about this … a central collection of the “right” public keys
to verify open source releases with would be useful in its own right. A
kind of trusted versioned keyserver (database archive with known hash).
Of course it would've been nice if the Web Of Trust had worked out, but
I don't see that happening. I myself am also guilty of not seing the
point in attending a key-signing event even when I was in the vicinity.
At least for the Source Mage project, an smgl-upstream-keys spell could
provide the same level of trust we have right now to the keys collected
in the grimoire. I like the idea of separating them into a spell even
if we keep on-cast GPG verificaton in combination with hash checking.
We could add support for the admin to add
to /usr/share/uptream-keys/local.gpg
(or /usr/local/share/upstream-keys/add.gpg, whatever) to have keys
marked as trusted for anything (even self-signing all sources once, for
some strange reason).
Alrighty then,
Thomas
-
[SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.,
Thomas Orgis, 02/27/2020
- Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no., Thomas Orgis, 02/28/2020
Archive powered by MHonArc 2.6.24.