[Gnu-arch-users] Re: signatures and checking

[Tom Lord]

    > From: Tom Lord <address@hidden>

    >     > From: Miles Bader <address@hidden>

    >     > Surely you can just treat the two cases separately:

    >     > Ask gpg (or whatever) to deliver the contents in case (2), by 
having a
    >     > `.arch-params/signing/*.contents' script, and just parse them 
directly in
    >     > case (1) (which is when you _don't_ have the script).

    >     > This would do the right thing, be simple to implement, not require 
any
    >     > awk scripts, and not require any new options to gpg....

    > Interesting idea but no.

    > That would create a partial exploit in which non .check'ing clients
    > saw different checksum data from .check'ing clients.

    > I don't immediately see any obvious way to turn that partial exploit
    > into a complete one --- but it seems needlessly fragile, nevertheless.


I suppose one way to do essentially that safely would be:

If there's a .check file, parse the checksum twice -- once raw and
once as the output of .check.   Make sure they agree.

But, really -- I think it's simpler just to toss a script into the
distro and update the HOWTO while waiting for gpg to get fixed.

-t