On Fri, Nov 05, 2004 at 12:34:32AM -0600, Satish Balay wrote:
On Thu, 4 Nov 2004, Peter Jones wrote:
> My model is that the signature is more than just a gpg signature.
> Conceptually, it's a signature on a certificate with data that
> specifies exactly which ways the package may be trusted. One
> could actually implement it that way, which I think we should, but
> it's some significant effort.
A signature is a signature, nothing more. You are talking about
policies, which are orthogonal to signing. Red Hat has policies,
ATrpms has policies, every repo has one, and they may partly
overlap. But you cannot (should not) deduce a policy from a signature.
The only thing IMHO a signature should be doing is to ensure the
package origin is from the key-holder of the package, nothing more. It
is a security, not policy entity.
Yeah - but we don't have that right now. The thing we are
debating is
- why signing 'rawhide' with gpg key is wrong.
Signing rawhide packages is not only right, but highly required. I
want to know whether mirror XYZ has untampered packages. If the
package is signed by the trusted Red Hat keys, I don't need to check
or care about mirror trusts. Unsigned packages on an insecure mirror
would go unnoticed if modified.
This mail is signed for the very same reason. There is no policy
behind signing my mail, other than ensuring noone can tamper with the
contents or send (signed) mails on my behalf.
> The specific proposal here was that when you *don't* mean
the things
> that people infer from a signed package, don't sign the package.
You mean Axel, Dag should't sign the packages they
distribute. (because that would imply its equally trustworthy as
redhat-certified)
And according to your model - If I were to distribure signed/unsigned
packages - the expection for unsigned is different(can eat data) - but
signed is different (extremely stable)
I'd say unsigned packages are just insecure, so they are also
unstable. OK ;)
--
Axel.Thimm at
ATrpms.net