[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <3a420f27-16ea-4f1b-9ac9-237683a94579@gentoo.org>
Date: Tue, 30 Dec 2025 21:37:39 -0500
From: Eli Schwartz <eschwartz@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Best practices for signature verifcation
Hi,
On 12/30/25 7:27 PM, Ali Polatel wrote:
> My initial goal is to switch signing Syd binary releases from gpg to
> signify. Next intention is to consider signing package manifests on
> Exherbo Linux distribution with it. If my memory serves me right,
> Gentoo Linux and Portage has support for GPG signed manifests and
> it has been a longstanding issue in Exherbo Linux how we want to
> do manifests. Current consensus is to use thin package manifests
> on a best-effort basis because we lack the developer time to go
> all in. Thin manifests store a single checksum and package size
> of the relevant package distfiles. My goal/dream is to integrate
> signify into this workflow and start signing thin manifests using
> signify.
If the Exherbo Linux distribution lacks enough manpower to include
checksums (which catch network errors, bitrot, and other forms of
corruption) even though other distros (including Gentoo) simply require
them and autocreate them,
then I cannot help but wonder who is going to go one step further and
also signify-sign the thin manifests that don't exist.
For context, Gentoo / portage requires Manifests, but not that they be
signed. git commit --gpg-sign is used as developer policy for the main
repos, and release infrastructure verifies those signed commits and when
exporting to an rsync tree, produces "GPG signed Manifests" (fat signed).
Checksumming your software downloads is not something that does (or
should?) require "developer time to go all in". It is basic
error-correction so you can detect malformed files and redownload. Your
tooling should simply do it for you.
It is also of course security-relevant as it provides Trust On First
Use. But it's not *only* for people who care about security.
--
Eli Schwartz
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
