3 ms·
>> a home-made public key signature format instead of PGP > How is 'openssl rsautl -sign' a "home-made" signature format? It's RAW RSA DATA. You could argue i
by ivoras 10y ago
>> a home-made public key signature format instead of PGP
> How is 'openssl rsautl -sign' a "home-made" signature format?
It's RAW RSA DATA. You could argue it's more pure that way but if that were the case, noone would ask for more metadata-rich signatures.
> As for using GPG... given its security track record, that's one of the last things I'd want to consider using for verifying signatures on binary updates.
If you don't see the NIH-ism in that sentence, then I'm sorry, neither I nor nobody else can help you.
> The pkg repository is signed.
Can individual package files be verified off-line?
- tedunangst 10y agoIs it not possible for cperciva's assessment of GPG to be accurate regardless of where it was invented?
- cperciva 10y agoWhether code is crap is a completely separate question from where it was invented. Putting signatures onto the individual package files could expose users to mismatch attacks, and would also make it harder to defend against build-trojan theft of signing keys.
- tptacek 10y agoI think Colin has the better argument here. You were hyperbolic when you called rsautl a "home-made format".
- feld 10y agoPackages are not meant to be distributed ad-hoc. You're meant to host a repo and sign it.