sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.

From: Ismael Luceno <ismael AT iodev.co.uk>
To: Thomas Orgis <thomas-forum AT orgis.org>
Cc: Eric Sandall <eric AT sandall.us>, sm-discuss AT lists.ibiblio.org
Subject: Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no.
Date: Mon, 16 Mar 2020 23:55:58 +0100

On 16/Mar/2020 23:28, Thomas Orgis wrote:
> Am Mon, 16 Mar 2020 23:11:45 +0100
> schrieb Ismael Luceno <ismael AT iodev.co.uk>:
>
> > I suggest the deprecation of the feature as a primary means of
> > verification.
>
> … and sorcery could switch to not using gpg for sha512, I guess? That's
> quite a bit of code gone from our sensitive toolchain.
>
> /var/lib/sorcery/modules/libunpack:
>
> ## In HASH mode:
> ## Validates the verification level (the third parameter) and the
> ## hash algorithm against user defined lists.
> ## It uses gpg to calculate the hash value except for md5 and sha1, which
> ## coreutils provides.
> ## see unpack_hash()
>
> $ gaze from sha256sum
> coreutils-8.30: /bin/sha256sum
> coreutils-8.28: /bin/sha256sum
> $ gaze from sha512sum
> coreutils-8.30: /bin/sha512sum
> coreutils-8.28: /bin/sha512sum

The comment is outdated, it doesn't depend on gpg anymore.

Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no., Eric Sandall, 03/06/2020
- Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no., Ismael Luceno, 03/16/2020
  - Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no., Thomas Orgis, 03/16/2020
    - Re: [SM-Discuss] Should we use UPSTREAM_GPG to verify sources for end-users (cast)? I say no., Ismael Luceno, 03/16/2020