Re: tag2upload (git-debpush) service architecture - draft

[Bastian Blank <waldi@debian.org>]

Hi Sam

On Wed, Jul 31, 2019 at 03:21:32PM -0400, Sam Hartman wrote:
>     Bastian> One last time: The user has to certify his upload in a way
>     Bastian> the archive can verify.
> Let me see if I'm correctly understanding this requirement.  You're
> saying that given the dsc presented to dak by the tag2upload service,
> dak needs to be able to verify the contents  of the DSC based on the
> user's signature and no external data.

Yes.

dak will push the signed .dsc into the pool.  This file and the complete
source package can then be verified independently by everyone.  We don't
need to trust ftp-master's verification of the signature.

> So, if the tag2upload service does some transformation to produce the
> dsc:
> 1) dak needs to be able to verify the inputs to that transformation
> and
> 2) confirm those inputs are certified back to a user signature.

Not only dak, but everyone who downloads the source package needs to be
able to verify the user signature.

Ian's tag2upload tool wants to replace the user signature with a tool
signature.  The user signature used as input for the tool would be not
longer verifyable, as the input is not provided.  So everything after
that would need to trust the tool and the instrastructure it runs on.
This means we would need to trust it more than we need to trust
ftp-master for source package verification.

> Have I understood your requirement?

Yes.

Regards,
Bastian

-- 
Without followers, evil cannot spread.
		-- Spock, "And The Children Shall Lead", stardate 5029.5