Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 21 Apr 2013 10:05:53 -0700
From: Alan Coopersmith <>
CC: Solar Designer <>
Subject: Re: upstream source code authenticity checking

On 04/20/13 01:39 PM, Solar Designer wrote:
> I just found this recent blog post by Allan McRae of Arch Linux:
> Thank you for doing this, Allan!  Are you contacting the upstream
> authors to request that they start to properly sign their releases?
> (I've been doing that on some occasions, sometimes with success.)

Coming from one of the common upstreams (X.Org), it would really be
helpful if there was a "Best Practices" page we could reference, since
we've gotten a couple complaints that we're not doing enough, but not
concrete enough suggestions that we can go modify our release script to
implement them.   (Currently we include MD5, SHA1, & SHA256 checksums in
the release announcement e-mails, which we tell maintainers to pgp sign
with their own keys when sending - though unfortunately most of the
mailing list archives break the ability to verify when they mangle
email addresses to prevent spam harvesting from their archives.)

If there was a common standard, with instructions, we'd be far more
likely to spend the time to adopt it, than just a "make signatures
appear somewhere, in an unspecified format".

	-Alan Coopersmith-    
	 Oracle Solaris Engineering -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.