git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Lack of detached signatures

From
Ted Ts'o <tytso@mit.edu>
Date
Sep 29, 2011, 13:18 UTC
Message-ID
<20110929131845.GQ19250@thunk.org>
In-Reply-To
<7vbou4uhuu.fsf@alter.siamese.dyndns.org>
On Wed, Sep 28, 2011 at 08:50:49PM -0700, Junio C Hamano wrote:
Show 8 quoted lines
> 
> I was actually more worried about helping consumers convince themselves
> that thusly signed keys indeed belong to producers like Linus, Peter,
> etc. There are those who worry that DNS record to code.google.com/ for
> them may point at an evil place to give them rogue download material.
> "Here are the keys you can verify our trees with" message on the mailing
> list, even with the message is signed with GPG, would not be satisfactory
> to them.

What do you mean by "consumers" in this context? Most end users don't actually download tarballs from www.kernel.org or code.google.com! :-)

If you mean developers at Linux distributions Red Hat, SuSE, or Handset manufacturers such as Samsung, HTC, Motorola, etc., there will be many of those reprsenatives at LinuxCon Europe and CELF (Consumer Electronics Linux Forum) Europe conferences, which will be colocated with the Kernel Summit in Prague.

If you are thinking of random developers located in far-flung places of the world who don't have any contact with other Linux developers, this is a previously unsolved problem. There are links into the developing Kernel GPG tree that are signed by the GPG web trust used by Debian, OpenSuSE, and (soon) Fedora. Given that people generally have to trust one or more of those web of trusts, that's the best we can do, at least as far as I know. If you can suggest something better, please let me know!

						- Ted
Previous: Junio C HamanoNext: Sverre Rabbelier
Message 15 of 24 in “Lack of detached signatures”
  1. Joseph ParmeleeSep 27, 2011
  2. Junio C HamanoSep 28, 2011
  3. Michael WittenSep 28, 2011
  4. Olsen, Alan RSep 28, 2011
  5. Carlos Martín NietoSep 28, 2011
  6. Joseph ParmeleeSep 28, 2011
  7. Junio C HamanoSep 28, 2011
  8. Michael WittenSep 28, 2011
  9. Matthieu MoySep 28, 2011
  10. Jeff KingSep 28, 2011
  11. Ted Ts'oSep 28, 2011
  12. Junio C HamanoSep 29, 2011
  13. Ted Ts'oSep 29, 2011
  14. Junio C HamanoSep 29, 2011
  15. Ted Ts'oSep 29, 2011
  16. Sverre RabbelierSep 29, 2011
  17. Ted Ts'oSep 29, 2011
  18. Sverre RabbelierSep 29, 2011
  19. Joseph ParmeleeSep 29, 2011
  20. Joseph ParmeleeSep 29, 2011
  21. Jeff KingSep 29, 2011
  22. Olsen, Alan RSep 29, 2011
  23. Joseph ParmeleeSep 28, 2011
  24. Ben WaltonSep 28, 2011

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.