GNU bug report logs - #17625
details of package signing mechanism

Previous Next

Full log

View this message in rfc822 format

From: Stefan Monnier <monnier <at> iro.umontreal.ca>
To: Glenn Morris <rgm <at> gnu.org>
Cc: Eric Abrahamsen <eric <at> ericabrahamsen.net>, 17625 <at> debbugs.gnu.org
Subject: bug#17625: 24.4.50; All installed packages marked "unsigned", no archive listed
Date: Sat, 31 May 2014 20:58:13 -0400

>> AFAIK we currently use http://elpa.gnu.org/packages/, so no SSL
>> involved.
> Right.  Will it Just Work to change that to https?

That would make libgnutls indispensable, and would also require us
getting the cert-verification working correctly.
Nothing significantly more troublesome than requiring users to have GPG
installed and have the ELPA key in the keyring.
And of course we'd need to make sure the "fallback to no checking"
works when gnutls/gpg is not available.

>> I don't enough about SSL certs to be sure whether it would provide
>> comparable guarantees to signed packages.
> I think SSL would verify that you are talking to the server that you
> thought you were talking too,

Right.

> and that no-one had injected anything in between you and it.

Presumably, yes.

> Which is all that gpg-signed packages would do, if the machine that
> hosts the packages also does the signing (AFAICS).

Of course, there are also hypothetical situations, such as someone
setting up a mirror.


        Stefan

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.