On 11/28/2011 10:56 AM, Ludwig Nussel wrote:

Administrator wrote:

...

I would suggest that, as a minimum, signing / build keys for main repos associated with openSUSE are signed by a main openSUSE key after (in some fashion) the requester's identity is verified. We can then (individually) decide to trust that signing process (and hence the signatures) or not.

I'm not sure I understand what you mean. The keys for the official repos are automatically in rpm's key ring of every installation. All packages in a repo as well as the repo itself are signed with the same key. The package signature is added automatically by the build system and testifies that a certain package was built in a certain project. The signing key cannot be set by the packager. IOW there is no point in establishing a web of trust with keys that identify people.

cu Ludwig

Ludwig, we have just one point to fix. Once a key has been trusted and installed, when it expires there's no warnings nor other way (as I know) than delete it, and push a new one if exists. -- Bruno Friedmann Ioda-Net Sàrl www.ioda-net.ch openSUSE Member & Ambassador GPG KEY : D5C9B751C4653227 irc: tigerfoot -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

On 30/11/11 07:48, Administrator wrote:

...

...

I would suggest that, as a minimum, signing / build keys for main repos associated with openSUSE are signed by a main openSUSE key after (in some fashion) the requester's identity is verified. We can then (individually) decide to trust that signing process (and hence the signatures) or not. I'm not sure I understand what you mean. The keys for the official repos are automatically in rpm's key ring of every installation. All packages in a repo as well as the repo itself are signed with the same key. The package signature is added automatically by the build system and testifies that a certain package was built in a certain project. The signing key cannot be set by the packager. IOW there is no point in establishing a web of trust with keys that identify people. I may be using the wrong terminology, but I get repeated warnings when updating the system that "The file repomd.xml ... is digitally signed with the following unknown GnuPG key ..." and then asked if I want to use it anyway. There is no way to check if the key referred to is valid.

It seems to happen a lot on the Java repository ...

It is happening on the Java repo almost everytime I do a zypper refresh. Happened several minutes ago. It is getting beyond being annoying. Makes one wonder if the maintainer knows what s/he is doing or whether the the repo is compromised. BC -- What religion were Adam and Eve? -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org

On Monday, November 28, 2011 03:56:23 AM Ludwig Nussel wrote:

The package signature is added automatically by the build system and testifies that a certain package was built in a certain project.

This is good, but still, how one can check is key originated from OBS or some malicious site. How to verify that key change, that happens from time to time, is regular replacement for expired key and not malicious activity, or sign that someone already used fake key, and now real one comes as "replacement"?

The signing key cannot be set by the packager. IOW there is no point in establishing a web of trust with keys that identify people.

While in current process there is no point of creating web of trust, the fact is that my trust in repository depends, among other things, on listed maintainers and their previous activity. -- Regards, Rajko -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org To contact the owner, email: opensuse-project+owner@opensuse.org