sm-discuss AT lists.ibiblio.org
Subject: Public SourceMage Discussion List
List archive
Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.
- From: Thomas Orgis <thomas-forum AT orgis.org>
- To: Ismael Luceno <ismael AT iodev.co.uk>
- Cc: Eric Sandall <eric AT sandall.us>, sm-discuss AT lists.ibiblio.org
- Subject: Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.
- Date: Mon, 16 Mar 2020 23:28:47 +0100
Am Mon, 16 Mar 2020 23:11:45 +0100
schrieb Ismael Luceno <ismael AT iodev.co.uk>:
> I suggest the deprecation of the feature as a primary means of
> verification.
… and sorcery could switch to not using gpg for sha512, I guess? That's
quite a bit of code gone from our sensitive toolchain.
/var/lib/sorcery/modules/libunpack:
## In HASH mode:
## Validates the verification level (the third parameter) and the
## hash algorithm against user defined lists.
## It uses gpg to calculate the hash value except for md5 and sha1, which
## coreutils provides.
## see unpack_hash()
$ gaze from sha256sum
coreutils-8.30: /bin/sha256sum
coreutils-8.28: /bin/sha256sum
$ gaze from sha512sum
coreutils-8.30: /bin/sha512sum
coreutils-8.28: /bin/sha512sum
Alrighty then,
Thomas
-
Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.,
Eric Sandall, 03/06/2020
-
Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.,
Ismael Luceno, 03/16/2020
-
Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.,
Thomas Orgis, 03/16/2020
- Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no., Ismael Luceno, 03/16/2020
-
Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.,
Thomas Orgis, 03/16/2020
-
Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.,
Ismael Luceno, 03/16/2020
Archive powered by MHonArc 2.6.24.