Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Thomas Orgis <thomas-forum AT orgis.org>
  • To: Ismael Luceno <ismael AT iodev.co.uk>
  • Cc: Eric Sandall <eric AT sandall.us>, sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.
  • Date: Mon, 16 Mar 2020 23:28:47 +0100

Am Mon, 16 Mar 2020 23:11:45 +0100
schrieb Ismael Luceno <ismael AT iodev.co.uk>:

> I suggest the deprecation of the feature as a primary means of
> verification.

… and sorcery could switch to not using gpg for sha512, I guess? That's
quite a bit of code gone from our sensitive toolchain.

/var/lib/sorcery/modules/libunpack:

## In HASH mode:
## Validates the verification level (the third parameter) and the
## hash algorithm against user defined lists.
## It uses gpg to calculate the hash value except for md5 and sha1, which
## coreutils provides.
## see unpack_hash()

$ gaze from sha256sum
coreutils-8.30: /bin/sha256sum
coreutils-8.28: /bin/sha256sum
$ gaze from sha512sum
coreutils-8.30: /bin/sha512sum
coreutils-8.28: /bin/sha512sum


Alrighty then,

Thomas




Archive powered by MHonArc 2.6.24.

Top of Page