Re: [PATCH] build: sign tarball instead of sha256sum

Subject: Re: [PATCH] build: sign tarball instead of sha256sum

Date: Fri, 15 Mar 2019 09:37:57 -0400

To: Adam Majer, David Bremner, Carl Worth, notmuch@notmuchmail.org

Cc:

From: Daniel Kahn Gillmor

On Fri 2019-03-15 12:35:55 +0100, Adam Majer wrote:
> # osc chroot
> running: sudo chroot /var/tmp/build-root/openSUSE_Tumbleweed-x86_64 su - 
> abuild
> # gpgv
> -bash: gpgv: command not found

That's surprising to me, but i'm ignorant about SUSE so you shouldn't be
surprised at my surprise :P

How does this system cryptographically verify its software updates?  or
is it never updated? or updated "from the outside" or something?

> Sorry, I meant clear signed and inline. The checksum file could just be 
> *.sha256 and be itself clear signed. Then people see as a checksum file 
> and when they look inside, they see it as signed. There is no reason to 
> have the checksum file encoded.

Ah, good call.  I agree that *.sha256.asc should be a clearsigned text
file instead of an ASCII-armored PGP message.  Thanks for catching that!

     --dkg

_______________________________________________
notmuch mailing list
notmuch@notmuchmail.org
https://notmuchmail.org/mailman/listinfo/notmuch

• Previous message (by thread): Re: [PATCH v2 1/3] build: ensure that SHA256_FILE is built

Thread:

• Adam Majer—Release signatures [inbox, unread]
  • David Bremner—Re: Release signatures [inbox, unread]
    • Carl Worth—Re: Release signatures [inbox, signed, unread]
      • David Bremner—[PATCH] build: sign tarball instead of sha256sum [inbox, notmuch::patch, notmuch::pushed, unread]
        • David Bremner—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, unread]
          • Daniel Kahn Gillmor—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, signed, unread]
            • David Bremner—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, unread]
              • Daniel Kahn Gillmor—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, signed, unread]
            • Adam Majer—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, unread]
              • Daniel Kahn Gillmor—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, signed, unread]
                • David Bremner—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, unread]
                  • Daniel Kahn Gillmor—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, signed, unread]
                    • David Bremner—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, unread]
                      • Daniel Kahn Gillmor—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, signed, unread]
                    • Adam Majer—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, unread]
                      • Daniel Kahn Gillmor—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, unread]
                    • Daniel Kahn Gillmor—[PATCH] build: distribute signed sha256sums [inbox, notmuch::obsolete, notmuch::patch, unread]
                      • Daniel Kahn Gillmor—[PATCH v2 1/3] build: ensure that SHA256_FILE is built [inbox, notmuch::patch, notmuch::pushed, unread]
                        • Daniel Kahn Gillmor—[PATCH v2 2/3] build: distribute signed sha256sums [inbox, notmuch::patch, notmuch::pushed, unread]
                        • Daniel Kahn Gillmor—[PATCH v2 3/3] build: Rename GPG_FILE to DETACHED_SIG_FILE [inbox, notmuch::patch, notmuch::pushed, unread]
                        • David Bremner—Re: [PATCH v2 1/3] build: ensure that SHA256_FILE is built [inbox, unread]
                • Adam Majer—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, unread]
                  • Daniel Kahn Gillmor—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, signed, unread]
                    • Adam Majer—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, unread]
                  • David Bremner—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, unread]
                    • Daniel Kahn Gillmor—Re: [PATCH] build: sign tarball instead of sha256sum [inbox, signed, unread]