From: sgn <sgn@users.noreply.github.com>
To: ml@inbox.vuxu.org
Subject: Re: keybase: use hand-generated tarball
Date: Thu, 09 Jul 2020 02:12:05 +0200 [thread overview]
Message-ID: <20200709001205.CTuDvFvu-F7yCd7ZAel89YmSXM7lXVFlusttiz-BWWA@z> (raw)
In-Reply-To: <gh-mailinglist-notifications-41a7ca26-5023-4802-975b-f1789d68868e-void-packages-23472@inbox.vuxu.org>
[-- Attachment #1: Type: text/plain, Size: 962 bytes --]
New comment by sgn on void-packages repository
https://github.com/void-linux/void-packages/pull/23472#issuecomment-655821350
Comment:
On 2020-07-08 11:06:38-0700, Piotr <notifications@github.com> wrote:
> Is varying checksum only reason? Contents checksum can be used then.
Yes, contents checksum can be used to verify all GitHub tarbals.
While we're switch to content checksum, we may as well switch to the
tarball signed by keybase. So, if anything shady in the tarball,
we can go straight (ehem) blame them instead GitHub.
Let's say about this theory:
- Some bad guys has control of the machine GitHub used to generate tarball,
and decided to always put a specific file in some specific repo,
- Content checksums is the always the same but it's not the tarball we
want.
In addition:
- Keybase is supposed to be a security software, so I think it's
better to double check the checksum with the upstream developer
before submit to Void
--
Danh
next prev parent reply other threads:[~2020-07-09 0:12 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-08 16:27 [PR PATCH] " sgn
2020-07-08 18:06 ` Chocimier
2020-07-09 0:12 ` sgn [this message]
2020-07-11 19:35 ` Chocimier
2020-07-12 0:55 ` sgn
2020-07-12 2:38 ` q66
2020-07-13 18:23 ` [PR PATCH] [Merged]: " Vaelatern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200709001205.CTuDvFvu-F7yCd7ZAel89YmSXM7lXVFlusttiz-BWWA@z \
--to=sgn@users.noreply.github.com \
--cc=ml@inbox.vuxu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).