Re: [PATCH] build: sign tarball instead of sha256sum

[David Bremner <david@tethera.net>]

Daniel Kahn Gillmor <dkg@fifthhorseman.net> writes:

> On Fri 2019-03-15 02:53:28 +0100, Adam Majer wrote:
>> adding explicit checks would add an extra BuildRequires in the build
>> process to pull in gpg, which is excessive.
>
> It shouldn't require gpg; it should only pull in gpgv, which is already
> on the base system, no?  And once the "small file" is checked, it would
> then require sha256sum (or the equivalent) to verify the tarball itself;
> on any modern system, that's likely to be available anyway
> (e.g. coreutils' sha256sum  or "openssl dgst" or whatever).

BTW gpg is needed to run the full test suite.

> But you're right that we could distribute a detached signature over the
> tarball in addition to the stronger mechanism.  that way people who have
> other defenses against rollback or version fixation attacks  (or who
> are willing to take the risk) can check the simpler, weaker mechanism.

BTW2: In a sense everyone has other defences since the tar ball contains a
file "version" with the version in it.

> David, how would you feel about generating two forms of cryptographic
> signature per-tarball as an interim process?

Yeah, that sounds fine. IIUC, the old .sha256.asc and the "new"
.tar.gz.asc?