From: Ladislav Hagara <ladislav.hagara AT unob.cz>
Cc: sm-commit AT lists.ibiblio.org
Subject: Re: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (ad0a24226e43aeb1ac12e792c02e31f3011852c4)
Date: Fri, 11 May 2007 21:52:35 +0200
> Then store the upstream signature for the release in the grimoire itself.
> Is there something preventing this from happening? It's been suggested
> many times.
So why nobody do it. Let's go.
It is not a problem only of "my" spells. It is a problem of all spells.
So all developers should store upstream signatures in grimoire.
All signatures of all vendor signed spells shoud be stored in grimoire.
The only one spell without signature in the grimoire can destroy all SMGL
boxes.
Hacker/cracker just steals vendor private key (we know nothing about security
policy of small project and we download sources and signatures form their
sites), modifies sources - added something like "rm -rf /*" to "configure"
and signs it.
IMHO, better than adding upstream signatures to the grimoire is just add next
level of checking of sources.
1st level - vendor/upstream signatures. 2th level - our own signatures or
hashes.