Public SourceMage Discussion List

[Thomas Orgis <thomas-forum AT orgis.org>]

Am Thu, 27 Feb 2020 11:06:15 +0100
schrieb Thomas Orgis <thomas-forum AT orgis.org>: 

>     Upstream signatures are there for the guru to verify and establish trust

For that purpose, I'd really like the gpg files from the grimoire to be
moved to a spell (the files themselves moved into an archive to be
summoned) which installs something like /usr/share/upstream-keys/*.gpg .
That way, they're actually more easy to use for interactive
verification, with a known location, and we get rid of the binary blobs
in the grimoire itself. That's 425 files with about 4M size total.
The're a bit compressible, so the net effect on grimoire.tar.bz2 is
from 13M to 10M if we leave them out.

Thinking about this … a central collection of the “right” public keys
to verify open source releases with would be useful in its own right. A
kind of trusted versioned keyserver (database archive with known hash).
Of course it would've been nice if the Web Of Trust had worked out, but
I don't see that happening. I myself am also guilty of not seing the
point in attending a key-signing event even when I was in the vicinity.

At least for the Source Mage project, an smgl-upstream-keys spell could
provide the same level of trust we have right now to the keys collected
in the grimoire. I like the idea of separating them into a spell even
if we keep on-cast GPG verificaton in combination with hash checking.
We could add support for the admin to add
to /usr/share/uptream-keys/local.gpg
(or /usr/local/share/upstream-keys/add.gpg, whatever) to have keys
marked as trusted for anything (even self-signing all sources once, for
some strange reason).


Alrighty then,

Thomas