From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rastus Vernon Subject: Re: Checking signatures on source tarballs Date: Wed, 14 Oct 2015 01:33:08 -0400 Message-ID: <1444800788.3026.16.camel@openmailbox.org> References: <1443791046-1015-1-git-send-email-alezost@gmail.com> <1443791046-1015-3-git-send-email-alezost@gmail.com> <87d1wvadw2.fsf@gnu.org> <87bnceah2e.fsf@gmail.com> <87r3la6077.fsf@gnu.org> <87eghalc7s.fsf@gmail.com> <87wpv1tils.fsf@gnu.org> <87a8rwf2vl.fsf@gmail.com> <8737xntorr.fsf_-_@netris.org> <87k2qy7uj7.fsf@gnu.org> <87io6iojmf.fsf@netris.org> <87bnca2y59.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:55060) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZmEgj-0005el-Uf for guix-devel@gnu.org; Wed, 14 Oct 2015 01:33:22 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZmEgg-0001Bu-Pu for guix-devel@gnu.org; Wed, 14 Oct 2015 01:33:21 -0400 Received: from smtp22.openmailbox.org ([62.4.1.56]:48607) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZmEgg-0001Ad-HH for guix-devel@gnu.org; Wed, 14 Oct 2015 01:33:18 -0400 In-Reply-To: <87bnca2y59.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: guix-devel@gnu.org When the code comes from a Git repository, it's possible for the source tarballs not to be signed (or not to exist at all), but for the tags in the repository to be signed at each release. In these cases, there is no signature file, but this is still a way for packagers to verify the authenticity of the source code. Ludovic Court=C3=A8s wrote: > When I download a package, the best I can do is to download its .sig=20 > and check it, optionally adding the corresponding public key to my > keyring if it=E2=80=99s missing. And that=E2=80=99s it. A small improvement is to download the signature from another location (for example a public library, or using a proxy or Tor) and compare the two to verify that they are the same. This makes a MiTM attack between the server and the computer the signature is downloaded to nearly impossible. The server could still be compromised, so this is not as good as having a trusted keyring, but it's a significant improvement.