Bugs for Sorcery are reported here

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=7838





------- Additional Comments From acedit AT armory.com  2005-02-07 12:07 -------
Partially yes.

The mirrors would download the grimoire/sorcery tarballs and the associated
signature file and mirror both of them. The signature guarantees that it was
signed by us [0].

The mirror would then only be able to mirror things we signed /at some point/.
The administration problem of mirroring out of date tarballs will remain. 
We'll
just have a guarantee that what they mirror was at some point what we 
considered
current. So if theres a security breach (in our stuff) that gets automatically
signed (or unknowingly signed by one of us) they can mirror it until we get 
them
off our mirror lists, which would likely be in sorcery, which they can just 
not
update either. Or if theres a security hole in a third party (say sendmail or
something) then they can just mirror the old grimoire with that hole in it
forever and launch targetted attacks on people who are getting that grimoire
from them (and prusumably some of them wont have caught on).

So this will make it "more secure" than it is now, currently anyone can mirror
anything, which is really bad. But theres definitly still ways to exploit this
gpg scheme through other means.

We really need a means to make our tarballs expire, but thats a different 
problem.

[0] where "us" and "we" is defined as an automated script using private keys 
on
the primary mirror, or a team lead on their personal machine using a key pair
listed in the appropriate keyring from sorcery-pubkeys.

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.