On Wed, Sep 05, 2007 at 06:13:07PM +0200, Dirk Stoecker wrote:
On Wed, 5 Sep 2007, Adrian Schröter wrote:
* People who currently use repositories from OBS will need to import the new gpg key(s). Otherwise the package managers will report errors.
Is signing with two keys possible? If so use a new buildservice key and still sign all packages with the old one (at least for older distributions). Add multi-key handling for openSUSE 10.3 and start using it there.
It is possible and we thought about it. The problem is that you can remove signatures from .asc files later on, just leaving one in them without knowing the private key of the one left. (A GPG signature is just a stream of data, which you can process.) However, we do not want to rely on trusting the OBS full key anymore, since in man-in-the-middle attack scenarios people could replace a "trusted" repo with their home repository.
* Allow upload of privates to be used to sign repos ? These keys *must not* get signed by the global OBS key, since they can be used elsewhere.
Don't think this is useful. I would not upload any of my private keys. But I would like to sign my repository-key with my private key. The buildservice should then provide the signed public keys.
You would generate a new one for the BS was the idea. But we were not convinced either this is a good idea. Of course you can sign your projects key with your own private keys.
* Does it make sense allow to reuse one key for multiple projects ? Does anyone want to have this at all ?
- If multiple signatures are possible, this would be useful. - Also it would be required to have only one key for subprojects (e.g. Education:xxx)
This is one line of thought we have not fully thought through. The problem here is you have different persons in different subprojects, and might want to differentiate between them. CIao, Marcus --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-buildservice+help@opensuse.org