Re: upstream source code authenticity checking

[Allan McRae <allan () archlinux org>]

On 21/04/13 06:39, Solar Designer wrote:
> Hi,
>
> I just found this recent blog post by Allan McRae of Arch Linux:
>
> http://allanmcrae.com/2012/04/how-secure-is-the-source-code/
>
> Thank you for doing this, Allan!  Are you contacting the upstream
> authors to request that they start to properly sign their releases?
> (I've been doing that on some occasions, sometimes with success.)

I have for a couple, but nothing across the whole board.

> I think that placing both "MD5 checksum provided on same site as
> download" and "PGP signature, key difficult to verify" in the same
> "yellow" category is inconvenient for us.  "MD5 checksum provided on
> same site as download" only helps verify downloads from mirrors against
> the master site, whereas "PGP signature, key difficult to verify"
> achieves a lot more - once a distro is already including the package
> (and has already taken the risk of it having been tampered with), then
> verifying further updates to the package becomes almost as reliable as
> it would have been with proper signing (with a "readily verifiable" key).
> So we need four categories, or simply "MD5 checksum provided on same
> site as download" should be in "red", not in "yellow".

I had yellow as "at least they tried...".  The could be categorised in
other ways, but that was a really quick survey of some core Linux
software, so I did not put that much thought into it.

Allan