[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-devel
Subject:    Re: digital signatures for kde =?UTF-8?Q?sources=3F?=
From:       Tom Albers <toma () kde ! org>
Date:       2010-05-26 9:07:24
Message-ID: 0171fea56e6c3499ff5630392b8ab055 () imap ! kovoks ! nl
[Download RAW message or body]


On Wed, 26 May 2010 10:37:57 +1000, Brad Hards <bradh@frogmouth.net>
wrote:
> This logic is basically one about putting an extra padlock on the front
> door, 
> when there is no back wall. There are 2395 svn accounts that can write
to
> the 
> repository, which is probably a much easier (i.e. more likely) place to 
> introduce untrustworthy code than the package tarballs.

Sure, but those commits go to a mailinglist, so everyone can check what
goes in. Detecting that a tarball has changed (or MITM) results in no
commit message to any list. Changing the published sha1sums is a lot harder
btw, as those are in svn too. But I don't think many check sha1sums.

If the workflow is anywhere near sane for signing tarballs, I agree we
should do them. 

Best,
-- 
Tom Albers
KDE Developer
 
>> Visit http://mail.kde.org/mailman/listinfo/kde-devel#unsub to unsubscribe <<
[prev in list] [next in list] [prev in thread] [next in thread]