Re: upstream source code authenticity checking

[Daniel Kahn Gillmor <dkg () fifthhorseman net>]

On Thu 2013-04-25 10:03:15 -0400, nicolas vigier wrote:

> The good thing about PGP signed tarballs is that an automated check
> could be integrated in package build, with some standard macros or
> script to make it easy to check signature from a specific key. If it's
> easy and does not cost time then more packagers will do it.

For debian, this suggestion was made in http://bugs.debian.org/610712
for the "uscan" tool, which looks for new upstream releases.

I've just supplied a patch to that bug with a simple implementation for
the common case where the signatures are distributed alongside the
tarballs with a similar name, and are made by one of a small set of
known keys.

It has some flaws, but it's certainly better than doing nothing.  I
welcome review and/or feedback and suggestions on that bug report.

Regards,

        --dkg

Attachment: _bin
Description: