Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

    On 2/28/20 07:14, Thomas Orgis wrote:
> Am Thu, 27 Feb 2020 11:06:15 +0100
> schrieb Thomas Orgis <thomas-forum AT orgis.org>: 
>
> >     Upstream signatures are there for the guru to verify and establish trust
> >       
> For that purpose, I'd really like the gpg files from the grimoire to be
> moved to a spell (the files themselves moved into an archive to be
> summoned) which installs something like /usr/share/upstream-keys/*.gpg .
> That way, they're actually more easy to use for interactive
> verification, with a known location, and we get rid of the binary blobs
> in the grimoire itself. That's 425 files with about 4M size total.
> The're a bit compressible, so the net effect on grimoire.tar.bz2 is
> from 13M to 10M if we leave them out.
>
> Thinking about this … a central collection of the “right” public keys
> to verify open source releases with would be useful in its own right. A
> kind of trusted versioned keyserver (database archive with known hash).
> Of course it would've been nice if the Web Of Trust had worked out, but
> I don't see that happening. I myself am also guilty of not seing the
> point in attending a key-signing event even when I was in the vicinity.
>
> At least for the Source Mage project, an smgl-upstream-keys spell could
> provide the same level of trust we have right now to the keys collected
> in the grimoire. I like the idea of separating them into a spell even
> if we keep on-cast GPG verificaton in combination with hash checking.
> We could add support for the admin to add
> to /usr/share/uptream-keys/local.gpg
> (or /usr/local/share/upstream-keys/add.gpg, whatever) to have keys
> marked as trusted for anything (even self-signing all sources once, for
> some strange reason).
>
>
> Alrighty then,
>
> Thomas
>     
    
    Those are all great points. :) I believe the UPSTREAM_GPG_KEY was
    when we assumed that upstream would always be a trusted
    source. It also avoided the issue when a tarball was re-relased
    without a new version tag, but was still properly signed, then we
    didn't have to do our own diff of the source code, do some
    sleuthing, and then update the SOURCE_HASH ourselves so that further
    casts would work. They're also convenient as we don't need to
    generate a hash on upgrades. ;)
    
    I agree with the overhead and us keeping track and verifying the GPG
    trustworthiness. I don't see much of a downside for going back to
    SOURCE_HASH only (some SMGL devs still use SOURCE_HASH instead of
    GPG even when available). This would also avoid the issue of when
    gnupg breaks (e.g. some upgrades) and we can no longer cast spells
    with source validation until we fix it.
    
    -Eric

Attachment: signature.asc
Description: OpenPGP digital signature