From: Konstantin Ryabitsev <konstantin@linuxfoundation.org>
Date: Tue, 31 Jan 2023 16:20:49 GMT
Subject: Re: Stability of git-archive, breaking (?) the Github universe, and a possible solution
Message-ID: <20230131162049.mgqdxcucjesw4afr@meerkat.local>
In-Reply-To: <6fc8e122-a190-c291-c347-258a5a2ad9c9@gmail.com>

On Tue, Jan 31, 2023 at 10:56:52AM -0500, Eli Schwartz wrote:
> And for tarballs that are generated once and uploaded to ftp storage,
> not repeatedly generated on the fly, we know the checksum will never
> legitimately change, so we *want* to hash the compressed file.
> Decompressing kernel.org tarballs in order to run PGP on them is *slow*.

FWIW, the most correct way is:

* download sha256sums.asc and verify its signature (auto-signed by infra)
* download the tarball you want and verify that the checksum matches
* uncompress and verify the PGP signature (signed by developer)

This script implements this workflow:
https://git.kernel.org/pub/scm/linux/kernel/git/mricon/korg-helpers.git/tree/get-verified-tarball

-K