Re: Alternative signature mechanisms for upstream source verification

Stefano Rivera <[email protected]> writes:

> Should we expand this to include some of these new mechanisms?
> Things brought up in the debian-python thread include:
> 1. sigstore https://docs.sigstore.dev/
> 2. ssh signatures
> 3. signify https://man.openbsd.org/signify.1

+1

I believe all signatures we trust should be encoded in a non-mutable
transparency log like Sigstore/Sigsum etc.  But the first step towards
that is to add support for verifying that property.

> There is a general trend towards getting upstream sources from Git
> rather than tarballs in Debian, but we're a long way from moving across
> completely, or even finding consensus to do so.
> These signature mechanisms can generally be applied to git commits as
> well as tarballs.

Signatures of git commits is the same as a signature on a SHA1 object
which is broken for authentication purposes.  But it is possible to
discuss these issues separately, paving the way for git commit signing
to be trustworthy when GitHub/GitLab moves to SHA256.

/Simon

-----BEGIN PGP SIGNATURE-----

iIoEARYIADIWIQSjzJyHC50xCrrUzy9RcisI/kdFogUCZwEWnRQcc2ltb25Aam9z
ZWZzc29uLm9yZwAKCRBRcisI/kdFoiJzAQCiA63P/cLfQZKPpjVnAYhNfBTNX52l
hEWyk7krfYlWWQEArjo1j/4/yWdL48UlmgvWMLaotP8eStD9+AP3Bzu5agk=
=8MHr
-----END PGP SIGNATURE-----