Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of chirino@gmail.com designates
 209.85.134.191 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:sender:to:subject:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references:x-google-sender-auth;
        b=Wf6md+vJNzXfGhYT0yvJqP2WsYVGZzgy+IN2C2WWAW3Wiwet9jdFLgk7FeuL9X10tX
         nJxP2UbXjbYSoR5+EfUQddsXeN1tXO7mZsZrfXEPutwLghSyzwf+HUuHDt76MXmHeFIO
         DEB9j5hA7FBbBHka0EoLft0IxCIuFfRUDQQjc=
Message-ID: <af2843cd0809220634w21f510e0le873d83985a473db@mail.gmail.com>
Date: Mon, 22 Sep 2008 09:34:50 -0400
From: "Hiram Chirino" <hiram@hiramchirino.com>
Sender: chirino@gmail.com
To: general@incubator.apache.org, henning@apache.org
Subject: Re: status of PGP support in Maven
In-Reply-To: <1221930522.25066.161.camel@forge.local>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <9e3862d80809150702y7492812coa2f8f0f1deb42970@mail.gmail.com>
	 <1221697970.25066.26.camel@forge.local>
	 <14976D4F-CEEB-41D7-B1AE-1A703E14462B@SUN.com>
	 <af2843cd0809190612l26a03571iad65544edd954372@mail.gmail.com>
	 <5c902b9e0809191011u72e8b83arfd6e49c5fc202214@mail.gmail.com>
	 <f470f68e0809200208r75cc59bdw74c6edf09d54f28c@mail.gmail.com>
	 <1221930522.25066.161.camel@forge.local>

The only reason I suggested including the sigs in the source distro is
because a source build like Apache ServiceMix depends on hundreds of
third party dependencies.. so an end user would need to end up
trusting LOTs different signatures to get ServiceMix to build.

It would be easier if the end user could just trust the Apache source
distro and also transitively trust the signatures that we trust for
our dependencies.

The end user would still need to manually validate the source distro signature.

Regards,
Hiram

On Sat, Sep 20, 2008 at 1:08 PM, Henning Schmiedehausen
<henning@apache.org> wrote:
> On Sat, 2008-09-20 at 10:08 +0100, Robert Burrell Donkin wrote:
>> On Fri, Sep 19, 2008 at 6:11 PM, Justin Erenkrantz
>> <justin@erenkrantz.com> wrote:
>> > On Fri, Sep 19, 2008 at 6:12 AM, Hiram Chirino <hiram@hiramchirino.com> wrote:
>> >> How about we include the signatures in the source distros?  That way
>> >> if you trust your source, then you can trust the dependencies it
>> >> downloads.
>> >
>> > Eww.  That'd be a giant gaping security hole.
>>
>> not necessarily, depends how it's done
>>
>> signing works through trusting the people who own the keys. given
>> sufficient signaturees (to prevent small conspiracies), where the
>> signatures are downloaded from shouldn't matter.
>
> Hiram suggested to put the signatures into the source, which in turn is
> also distributed from the repo. If you compromise the repo and change
> the artifact, it is trivial to update the source artifact to contain a
> matching signature.
>
> This is a security hole. And I don't really care for some of the
> proposed "high nineties" security solutions. Either a solution is secure
> or it is not. Everything else is just FUD.
>
> The problem with the central repo is that you need an easy accessible
> web of trust if you want validation. The Apache web of trust is
> distributed and an overlay to the GPG web of trust. But if you live in
> Juneau, Alaska, it is hard for you to access it and get a trust
> relationship to it.
>
> There is a (bit rusty) proposal on how to improve this at
> http://people.apache.org/~henkp/trust/
>
>        Ciao
>                Henning
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>


-- 
Regards,
Hiram

Blog: http://hiramchirino.com

Open Source SOA
http://open.iona.com

---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org