Skip to Content.
Sympa Menu

sm-security - [SM-Security] Re: [SM-Grimoire] grimoire rsync

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: Hamish Greig <hgreig AT bigpond.net.au>
  • Cc: Source Mage - Security <sm-security AT lists.ibiblio.org>, Source Mage - Grimoire <sm-grimoire AT lists.ibiblio.org>
  • Subject: [SM-Security] Re: [SM-Grimoire] grimoire rsync
  • Date: Wed, 11 Jun 2003 04:42:32 -0400

I think a spell is the lowest level at which it makes sense to provide cryptographic protection. If part of the spell is compromised, the whole spell is compromised. OTOH, if one spell is compromised, entire grimoire with all other spells, as well as sorcery, is not.

Hamish Greig wrote:

Hmm Sounds rather involved Seth?

If the following is possible it might be simpler?
Perforce and cvs only allow access from registered/ authorised users so we maintain development in that environment. For distribution of the grimoire we have two options.
1) download a signed tarball for stable, test, devel. can default to this if current grimoire is more then 2weeks (example only) old.
2) Serve a signed {stable/test/devel } grimoire tree, where all files are signed (detached) and the rsync process is piped through gpg allowing verification before reintegration to local grimoire. Local unnecessary copies of sig file can be deleted after the update. Gpg checks are made before writing to local disk not after, so customisations can be made without causing the update process to choke.
The second option still allows minimal download pre update and gives good security, without overheads and all that extra storage is not needed.
Plus it also allows for a per file exclusion (if wanted) similar to the "add options to configure" during cast.
The only way that epoch matters is if it has been a long time since update and then it will update the whole grimoire (still using signed tarballs,for security) . For periods within that time frame it won't matter what version of the file you have as rsync will just update it to the current regardless of whether or not the file is 1MB or 0bytes.
Please point out my faulty logic, poor knowledge of 1's and 0's or tell me how attrocious my dress sense is ;-)
All responses welcome.....
Hamish

Do You SMuGL!?
Linux so advanced it may as well be magic!
Everything you'll ever need on one web page
http://www.sourcemage.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE+5ucM8fSufZR6424RAth1AJ9SsMGq1RFh0dy6ggpy7dtEIFEUuwCfauze
FhUJkyrcwogjuUOak/Y28Qo=
=E8VW
-----END PGP SIGNATURE-----

_______________________________________________
SM-Grimoire mailing list
SM-Grimoire AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/sm-grimoire






Archive powered by MHonArc 2.6.24.

Top of Page