Re: tag2upload service architecture and risk assessment - draft v2

[Ian Jackson <ijackson@chiark.greenend.org.uk>]

Russ Allbery writes ("Re: tag2upload service architecture and risk assessment - draft v2"):
> For who-uploads, I think you just need a trusted metadata store somewhere,
> and recovering this from the PGP signatures on *.dsc files is not a great
> trusted metadata store (among other things, it's tedious and complicated
> to search).

Also, my proposal includes the original uploader information in
additional .dsc fields.  So wouldn't be hard to teach existing
machineries (which look at the .dsc signer) to use the new
information, and there is no actual need for a new database anywhere.

> The cryptographic binding becomes important if we for some reason don't
> trust archive upload records maintained by DAK, and I'm not sure of a use
> case for that.

In my proposal the source package is reproducible (in the
"reproducible builds" sense) from the uploader's signed git tag.  That
is admittedly less convenient to verify than the just checking the
.dsc signature.

Ian.

-- 
Ian Jackson <ijackson@chiark.greenend.org.uk>   These opinions are my own.

If I emailed you from an address @fyvzl.net or @evade.org.uk, that is
a private address which bypasses my fierce spamfilter.