On Fri, Nov 05, 2004 at 12:34:32AM -0600, Satish Balay wrote: > On Thu, 4 Nov 2004, Peter Jones wrote: > > My model is that the signature is more than just a gpg signature. > > Conceptually, it's a signature on a certificate with data that > > specifies exactly which ways the package may be trusted. One > > could actually implement it that way, which I think we should, but > > it's some significant effort. A signature is a signature, nothing more. You are talking about policies, which are orthogonal to signing. Red Hat has policies, ATrpms has policies, every repo has one, and they may partly overlap. But you cannot (should not) deduce a policy from a signature. The only thing IMHO a signature should be doing is to ensure the package origin is from the key-holder of the package, nothing more. It is a security, not policy entity. > Yeah - but we don't have that right now. The thing we are debating is > - why signing 'rawhide' with gpg key is wrong. Signing rawhide packages is not only right, but highly required. I want to know whether mirror XYZ has untampered packages. If the package is signed by the trusted Red Hat keys, I don't need to check or care about mirror trusts. Unsigned packages on an insecure mirror would go unnoticed if modified. This mail is signed for the very same reason. There is no policy behind signing my mail, other than ensuring noone can tamper with the contents or send (signed) mails on my behalf. > > The specific proposal here was that when you *don't* mean the things > > that people infer from a signed package, don't sign the package. > > You mean Axel, Dag should't sign the packages they > distribute. (because that would imply its equally trustworthy as > redhat-certified) > > And according to your model - If I were to distribure signed/unsigned > packages - the expection for unsigned is different(can eat data) - but > signed is different (extremely stable) I'd say unsigned packages are just insecure, so they are also unstable. OK ;) -- Axel.Thimm at ATrpms.net
Attachment:
pgphJJpX9EXdP.pgp
Description: PGP signature