oss-sec mailing list archives
Re: upstream source code authenticity checking
From: Russ Allbery <rra () stanford edu>
Date: Thu, 02 May 2013 14:00:10 -0700
Alan Coopersmith <alan.coopersmith () oracle com> writes:
On 05/ 2/13 11:10 AM, Russ Allbery wrote:
I routinely do this. It's called a key-signing party. The only trust that I am expressing with that signature is that I have seen and verified, to the best of my ability, some form of reliable identification for that person (ideally a passport I can verify, or a social environment in which it would be very difficult to impersonate someone you are not) in combination with a proof that the key I signed belongs to the person whose identification I checked.
Though for many open source projects, having a passport or other government id is not the sort of identity we care about - knowing that you're the person who does git/hg commits under that e-mail address is what we care about - if it's a pseudonym that doesn't match your passport, that doesn't affect whether we accept code from you or not. (The lawyers might care, when it comes to verifying who owns copyright and agreed to release code under a given license, but that's a whole separate mess to unravel.)
Right. And that's part of the problem with using existing PGP key signatures. They don't convey the piece of information that the project probably actually cares about. Open source projects rarely care that I'm *actually* Russ Allbery, rather than just using that name on-line while actually legally being named Roger McDowell. Lawyers may care if they want to be able to sue me, but that's an edge case. What projects actually care about is that I'm the same person, by whatever name, who has an established track record in multiple other projects and an established trust basis in the broader community. You can kind of get there by tying together multiple different pieces of data, but it's certainly not directly conveyed by PGP key signatures. -- Russ Allbery (rra () stanford edu) <http://www.eyrie.org/~eagle/>
Current thread:
- Re: upstream source code authenticity checking, (continued)
- Re: upstream source code authenticity checking Kurt Seifried (Apr 26)
- Re: upstream source code authenticity checking Eric H. Christensen (Apr 29)
- Re: upstream source code authenticity checking Daniel Kahn Gillmor (Apr 30)
- Re: upstream source code authenticity checking Robbie MacKay (May 01)
- Re: upstream source code authenticity checking Alistair Crooks (May 02)
- OpenPGP certifications are identity assertions [was: Re: upstream source code authenticity checking] Daniel Kahn Gillmor (May 02)
- Re: OpenPGP certifications are identity assertions [was: Re: upstream source code authenticity checking] Simon McVittie (May 02)
- Re: upstream source code authenticity checking Kurt Seifried (May 02)
- Re: upstream source code authenticity checking Russ Allbery (May 02)
- Re: upstream source code authenticity checking Alan Coopersmith (May 02)
- Re: upstream source code authenticity checking Russ Allbery (May 02)
- Re: upstream source code authenticity checking Josh Bressers (Apr 25)
- Re: upstream source code authenticity checking Alistair Crooks (Apr 25)
- Re: upstream source code authenticity checking Marcus Meissner (Apr 26)
- Re: upstream source code authenticity checking nicolas vigier (Apr 25)
- Re: upstream source code authenticity checking Alistair Crooks (Apr 25)
- Re: upstream source code authenticity checking Florian Weimer (Apr 26)
- Re: upstream source code authenticity checking yersinia (Apr 26)
- Re: upstream source code authenticity checking Daniel Kahn Gillmor (May 04)