3 ms·
Verifying the signature wouldn't have been that helpful. A different attacker might generate a similar key with the same name and sign the archive with that. Ho
by rlpb 15y ago
Verifying the signature wouldn't have been that helpful. A different attacker might generate a similar key with the same name and sign the archive with that. How many of you check signature fingerprints (and how?) or have a chain of trust that leads to the maintainer?
- perlgeek 15y agoIn this case pretty low, because the maintainer's key is not in the "strong set" of the web of trust. However there are more than 40k keys in that strongest set (see http://pgp.cs.uu.nl/plot/ http://pgp.cs.uu.nl/plot/ for example), and if you care, you can easily get into that set by attending a key signing party a big open source conference. (I participated at a DebConf and LinuxTag, but I'm pretty sure OSCON also has one...)