Re: GNU Shepherd 0.8.1 released

[Bengt Richter <bokr@bokr.com>]

Hi Ludo, et al,

Would there be a benefit from NOT using .sig's from mirrors
while getting corresponding .tgz's from mirrors to help with traffic?

On +2020-06-03 14:48:23 +0200, Ludovic Courtès wrote:
> We are pleased to announce the GNU Shepherd version 0.8.1.  This release
> represents 16 commits by 4 people, bringing an important bug fix and
> improvements to the code.
[...]
> • Download
> 
>   Here are the compressed sources and a GPG detached signature[*]:
>     https://ftp.gnu.org/gnu/shepherd/shepherd-0.8.1.tar.gz
>     https://ftp.gnu.org/gnu/shepherd/shepherd-0.8.1.tar.gz.sig
> 
>   Use a mirror for higher download bandwidth:
>     https://ftpmirror.gnu.org/shepherd/shepherd-0.8.1.tar.gz
>     https://ftpmirror.gnu.org/shepherd/shepherd-0.8.1.tar.gz.sig
> 
>   Here are the SHA1 and SHA256 checksums:
> 
>   2964502388aa74207e6761c2ff77df69369738b0  shepherd-0.8.1.tar.gz
>   d32fe58694bb5350b5fc7285cf0ca0d9c7d24221aa5969d6c464ee3e3ac83f75  shepherd-0.8.1.tar.gz
> 
>   [*] Use a .sig file to verify that the corresponding file (without the
>   .sig suffix) is intact.  First, be sure to download both the .sig file
>   and the corresponding tarball.  Then, run a command like this:
> 
>     gpg --verify shepherd-0.8.1.tar.gz.sig
[...]

I am wondering if downloading the .sig file from
>     https://ftp.gnu.org/gnu/shepherd/shepherd-0.8.1.tar.gz.sig
(to make sure it is the latest official sig, even if mirrors haven't caught up)

and the big file from a mirror:
(to avoid overloading the official non-mirror server)
>     https://ftpmirror.gnu.org/shepherd/shepherd-0.8.1.tar.gz
would be a good thing to do for server traffic, while ensuring that
I would detect a stale tar.gz if it didn't correspond to the official .sig.

Of course one would discover it if one used the sha256sums in the announcement,
but could one be fooled by gpg's accepting a valid-as-pair tgz/sig pair where
both were actually out of date?

If so, could a class of errors and potential vulns be eliminated by not servings .sig's
at all from mirrors? (it would be inconvenient when official server was down, but
not a showstopper inconvenience, since the tgz would be be mirrored and could be
validated with published sha256sum's).

-- 
Regards,
Bengt Richter