Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.
  • Date: Fri, 6 Mar 2020 10:19:07 -0800

On 2/28/20 07:14, Thomas Orgis wrote:
Am Thu, 27 Feb 2020 11:06:15 +0100
schrieb Thomas Orgis <thomas-forum AT orgis.org>: 

    Upstream signatures are there for the guru to verify and establish trust
For that purpose, I'd really like the gpg files from the grimoire to be
moved to a spell (the files themselves moved into an archive to be
summoned) which installs something like /usr/share/upstream-keys/*.gpg .
That way, they're actually more easy to use for interactive
verification, with a known location, and we get rid of the binary blobs
in the grimoire itself. That's 425 files with about 4M size total.
The're a bit compressible, so the net effect on grimoire.tar.bz2 is
from 13M to 10M if we leave them out.

Thinking about this … a central collection of the “right” public keys
to verify open source releases with would be useful in its own right. A
kind of trusted versioned keyserver (database archive with known hash).
Of course it would've been nice if the Web Of Trust had worked out, but
I don't see that happening. I myself am also guilty of not seing the
point in attending a key-signing event even when I was in the vicinity.

At least for the Source Mage project, an smgl-upstream-keys spell could
provide the same level of trust we have right now to the keys collected
in the grimoire. I like the idea of separating them into a spell even
if we keep on-cast GPG verificaton in combination with hash checking.
We could add support for the admin to add
to /usr/share/uptream-keys/local.gpg
(or /usr/local/share/upstream-keys/add.gpg, whatever) to have keys
marked as trusted for anything (even self-signing all sources once, for
some strange reason).


Alrighty then,

Thomas

Those are all great points. :) I believe the UPSTREAM_GPG_KEY was when we assumed that upstream would always be a trusted source. It also avoided the issue when a tarball was re-relased without a new version tag, but was still properly signed, then we didn't have to do our own diff of the source code, do some sleuthing, and then update the SOURCE_HASH ourselves so that further casts would work. They're also convenient as we don't need to generate a hash on upgrades. ;)

I agree with the overhead and us keeping track and verifying the GPG trustworthiness. I don't see much of a downside for going back to SOURCE_HASH only (some SMGL devs still use SOURCE_HASH instead of GPG even when available). This would also avoid the issue of when gnupg breaks (e.g. some upgrades) and we can no longer cast spells with source validation until we fix it.

-Eric

Attachment: signature.asc
Description: OpenPGP digital signature




Archive powered by MHonArc 2.6.24.

Top of Page