Skip to Content.
Sympa Menu

sm-sorcery-bugs - [SM-Sorcery-Bugs] [Bug 8047] gpg checking for spells

sm-sorcery-bugs AT lists.ibiblio.org

Subject: Bugs for Sorcery are reported here

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-sorcery-bugs AT lists.ibiblio.org
  • Subject: [SM-Sorcery-Bugs] [Bug 8047] gpg checking for spells
  • Date: Thu, 20 Jan 2005 17:06:08 -0800 (PST)

http://bugs.sourcemage.org/show_bug.cgi?id=8047





------- Additional Comments From acedit AT armory.com 2005-01-20 17:06 -------
Im not sure how or where I said that we dont need gpg signatures for sources.

Thats absolutely the problem to be solved by this feature. Sources have
signatures, we have the keys, we verify the signature against the source with
the key. Did I miss something?

Also, it is possible and somewhat explained in seth's draft specification to
have multiple keyrings layed out through the grimoire. At the top level we
have
two cases:
a) the third party signs their software properly
in this case we keep their public key(s) in a keyring for that spell and
include
it with the grimoire, the spell then point to that keyring file and also
points
to a url for the signature which is fetched and verified.

b) the third party does NOT sign their software, or does so improperly
in this case the spell maintainer personally signs the source file with their
key and either keeps the signature with the spell.

The smgl developer's key may be stored directly in that spell, in a
sectionwide
keyring or a grimoirewide keyring, or in some other ad-hoc fashion. This is
purely up to the grimoire team. The only restriction is that the keyring is
distributed with the grimoire (so as to be kept under the umbrella of grimoire
wide signatures, and within that grimoire, not be in a subdirectory that is
not
either a section or a spell (this is imposed by tablet).

An alternative to the case of b is to continue to use MD5 verification. SHA1
verification is a possibility but not within the scope of this bug.

It is certainly possible in the case of b to have a single keyring of all smgl
developers for the entire grimoire and always point the spell there for the
validation key, then whichever developer updates the spell resigns the tarball
with their key and updates the signature (which again, is included with the
spell). The pointer to the keyring never has to be updated and gpg will find
the
correct key in the keyring.

Let it also be clear that the HISTORY file is not to be used as a means to
discern any information about the spell other than that which would be of
interest to a human. In other words, we will never parse history files to find
out something about a spell, why has that become a topic of discussion lately

This is really no more work than md5sum checking, in either case you update
one
thing, or in some case *gasp* the key AND the signature. It takes a near
trivial
amount of time but provides a greatly enhanced level of security over md5 with
the advantage of well kept sources not needing any updates at all.

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.




Archive powered by MHonArc 2.6.24.

Top of Page