Public SourceMage Discussion List

[Ismael Luceno <ismael AT iodev.co.uk>]

On 06/Mar/2020 10:19, Eric Sandall via SM-Discuss wrote:
> On 2/28/20 07:14, Thomas Orgis wrote:
> > Am Thu, 27 Feb 2020 11:06:15 +0100
> > schrieb Thomas Orgis <thomas-forum AT orgis.org>: 
> >
> >>     Upstream signatures are there for the guru to verify and establish 
> >> trust
> > For that purpose, I'd really like the gpg files from the grimoire to be
> > moved to a spell (the files themselves moved into an archive to be
> > summoned) which installs something like /usr/share/upstream-keys/*.gpg .
> > That way, they're actually more easy to use for interactive
> > verification, with a known location, and we get rid of the binary blobs
> > in the grimoire itself. That's 425 files with about 4M size total.
> > The're a bit compressible, so the net effect on grimoire.tar.bz2 is
> > from 13M to 10M if we leave them out.
> >
> > Thinking about this … a central collection of the “right” public keys
> > to verify open source releases with would be useful in its own right. A
> > kind of trusted versioned keyserver (database archive with known hash).
> > Of course it would've been nice if the Web Of Trust had worked out, but
> > I don't see that happening. I myself am also guilty of not seing the
> > point in attending a key-signing event even when I was in the vicinity.
> >
> > At least for the Source Mage project, an smgl-upstream-keys spell could
> > provide the same level of trust we have right now to the keys collected
> > in the grimoire. I like the idea of separating them into a spell even
> > if we keep on-cast GPG verificaton in combination with hash checking.
> > We could add support for the admin to add
> > to /usr/share/uptream-keys/local.gpg
> > (or /usr/local/share/upstream-keys/add.gpg, whatever) to have keys
> > marked as trusted for anything (even self-signing all sources once, for
> > some strange reason).
> >
> >
> > Alrighty then,
> >
> > Thomas
> 
> Those are all great points. :) I believe the UPSTREAM_GPG_KEY was when
> we assumed that upstream would /always/ be a trusted source. It also
> avoided the issue when a tarball was re-relased without a new version
> tag, but was still properly signed, then we didn't have to do our own
> /diff/ of the source code, do some sleuthing, and then update the
> SOURCE_HASH ourselves so that further casts would work. They're also
> convenient as we don't need to generate a hash on upgrades. ;)
> 
> I agree with the overhead and us keeping track and verifying the GPG
> trustworthiness. I don't see much of a downside for going back to
> SOURCE_HASH only (some SMGL devs still use SOURCE_HASH instead of GPG
> even when available). This would also avoid the issue of when gnupg
> breaks (e.g. some upgrades) and we can no longer cast spells with source
> validation until we fix it.
> 
> -Eric

+1 to all points.

I suggest the deprecation of the feature as a primary means of
verification.