git/list[1] front-page[2] threads[3] people[4] search[5] about
 

RE: Lack of detached signatures

From
OROlsen, Alan R <alan.r.olsen@intel.com>
Date
Sep 29, 2011, 20:31 UTC
Message-ID
<4B2793BF110AAB47AB0EE7B90897038516F68647@ORSMSX101.amr.corp.intel.com>
In-Reply-To
<20110928230958.GJ19250@thunk.org>
[Sorry for the top posting. Fscking Outlook demands it.]
The value of detached signatures is not that the users catch a hacked version, it is that the automated build bots catch the hacked version.  There was a server compromised a number of years back that was not caught by users, but by the Gentoo build bot.
What I would eventually like to see is a similar way to check an existing git tree and make sure all the commits authenticate and have not been tampered with.  That is a harder problem since the actual patch can change during a merge. (Having cryptographic sign-offs would be helpful as well. I have seen a few cases internally where the signoffs were for bogus e-mail addresses that got generated by automated tools, as well as patches that got altered after the sign-off.)
-----Original Message-----
From: Ted Ts'o [mailto:tytso@mit.edu] 
Sent: Wednesday, September 28, 2011 4:10 PM
To: Jeff King
Cc: Junio C Hamano; Joseph Parmelee; Carlos Martín Nieto; Olsen, Alan R; Michael Witten; git@vger.kernel.org
Subject: Re: Lack of detached signatures
On Wed, Sep 28, 2011 at 06:25:43PM -0400, Jeff King wrote:
Show 5 quoted lines
> [1] This is a minor nit, and probably not worth breaking away from the
> way the rest of the world does it, but it is somewhat silly to sign the
> compressed data. I couldn't care less about the exact bytes in the
> compressed version; what I care about is the actual tar file. The
> compression is just a transport.

The worry I have is that many users don't check the GPG checksum files as it is. If they have to decompress the file, and then run gpg to check the checksum, they might never get around to doing it.

That being said, I'm not sure I have a good solution. One is to ship the file without using detached signatures, and ship a foo.tar.gz.gpg file, and force them to use GPG to unwrap the file before it can be unpacked. But users would yell and scream if we did that...

	       	     	   	    	   - Ted
Previous: Jeff KingNext: Joseph Parmelee
Message 22 of 24 in “Lack of detached signatures”
  1. Joseph ParmeleeSep 27, 2011
  2. Junio C HamanoSep 28, 2011
  3. Michael WittenSep 28, 2011
  4. Olsen, Alan RSep 28, 2011
  5. Carlos Martín NietoSep 28, 2011
  6. Joseph ParmeleeSep 28, 2011
  7. Junio C HamanoSep 28, 2011
  8. Michael WittenSep 28, 2011
  9. Matthieu MoySep 28, 2011
  10. Jeff KingSep 28, 2011
  11. Ted Ts'oSep 28, 2011
  12. Junio C HamanoSep 29, 2011
  13. Ted Ts'oSep 29, 2011
  14. Junio C HamanoSep 29, 2011
  15. Ted Ts'oSep 29, 2011
  16. Sverre RabbelierSep 29, 2011
  17. Ted Ts'oSep 29, 2011
  18. Sverre RabbelierSep 29, 2011
  19. Joseph ParmeleeSep 29, 2011
  20. Joseph ParmeleeSep 29, 2011
  21. Jeff KingSep 29, 2011
  22. Olsen, Alan RSep 29, 2011
  23. Joseph ParmeleeSep 28, 2011
  24. Ben WaltonSep 28, 2011

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.