All of lore.kernel.org
 help / color / mirror / Atom feed
From: Christian Rebischke <Chris.Rebischke@archlinux.org>
To: Steve Grubb <sgrubb@redhat.com>
Cc: linux-audit@redhat.com
Subject: Re: signed tarballs
Date: Sat, 15 Apr 2017 01:03:18 +0200	[thread overview]
Message-ID: <20170414230318.GA22493@motoko> (raw)
In-Reply-To: <6911467.0fbbL1krjI@x2>


[-- Attachment #1.1: Type: text/plain, Size: 829 bytes --]

On Fri, Apr 14, 2017 at 09:38:51AM -0400, Steve Grubb wrote:
> As I said in a subsequent email, "we'll go with hashes now and 
> work up to signing another day." But I really am serious that the biggest 
> threat to the project is not some wild eyed MITM attack targeting a whole 
> distribution. Its me. I doubt few people truly understand the impact of the 
> bug that Laurent reported and why it moved me to change plans and do a quick 
> release. (It was not because ausearch was segfaulting.) Again, I call for more 
> testing and bug reports. I know they are in the code. I find a couple every 
> day or two.

Yep, the first factor is the code. But keep in mind that signing
tarballs are just 5 minutes of work per release. I see no reason why
audit shouldn't do it, all other redhat projects do it too.




[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]



      reply	other threads:[~2017-04-14 23:03 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-04-06 23:31 signed tarballs Christian Rebischke
2017-04-07  1:27 ` William Roberts
2017-04-07 23:41   ` Christian Rebischke
2017-04-07 23:52     ` William Roberts
2017-04-08 12:53 ` Paul Moore
2017-04-10 18:51   ` Steve Grubb
2017-04-10 18:35 ` Steve Grubb
2017-04-11 10:44   ` Christian Rebischke
2017-04-11 14:03     ` Steve Grubb
2017-04-13 20:28       ` Christian Rebischke
2017-04-13 20:30         ` William Roberts
2017-04-13 20:43           ` Steve Grubb
2017-04-13 20:56           ` Christian Rebischke
2017-04-13 21:00             ` William Roberts
2017-04-13 21:05               ` Paul Moore
2017-04-13 21:08                 ` William Roberts
2017-04-13 21:17                   ` Paul Moore
2017-04-13 22:39                     ` William Roberts
2017-04-13 21:22                 ` Christian Rebischke
2017-04-13 22:45                   ` William Roberts
2017-04-13 23:17                     ` Steve Grubb
2017-04-13 22:25                 ` Steve Grubb
2017-04-14 13:06                   ` Paul Moore
2017-04-14 13:38                     ` Steve Grubb
2017-04-14 23:03                       ` Christian Rebischke [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170414230318.GA22493@motoko \
    --to=chris.rebischke@archlinux.org \
    --cc=linux-audit@redhat.com \
    --cc=sgrubb@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.