From: Greg KH <greg@kroah.com>
To: Valdis.Kletnieks@vt.edu
Cc: Jari Ruusu <jariruusu@users.sourceforge.net>,
linux-kernel@vger.kernel.org
Subject: Re: kernel.org tarball/patch signature files
Date: Tue, 25 Oct 2011 09:34:54 +0200 [thread overview]
Message-ID: <20111025073454.GA14967@kroah.com> (raw)
In-Reply-To: <11749.1319527717@turing-police.cc.vt.edu>
On Tue, Oct 25, 2011 at 03:28:37AM -0400, Valdis.Kletnieks@vt.edu wrote:
> On Tue, 25 Oct 2011 03:49:11 +0200, Greg KH said:
>
> > The real check, to verify that this tarball really came from "me" should
> > be done on the uncompressed tarball, which is what I can sign, and it is
> > something that you, or anyone else, can reliable duplicate on their own
> > by just using git and not even downloading the tarball at all.
>
> I'm OK on that part..
>
> > In other words, we just saved you a MASSIVE bandwidth transation for all
> > of your future kernel downloads, and you can reliable know that the
> > tarball you have in your system is what is on the kernel.org servers
> > without you even having to download it yourself and run those
> > decompression tools that you don't trus.
>
> If you're building an automated process that will take a just-uploaded foo.tar
> and generate foo.tar.{bz2,gz,foozip}, can you add a step that would just do an
> 'md5sum foo.tar.* > foo.tar.sums'? Or sha256sum if you're worried about the
> crypto weakness issues with MD5. Personally, I'm more interested in the "Did I
> hit a network error that the TCP checksum didn't catch?" case.
Yes, we are working on just that thing, and the foo.tar.sums file will
be signed with the kernel.org "throwaway" key, so you can check that as
well.
greg k-h
next prev parent reply other threads:[~2011-10-25 7:35 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-10-23 11:17 kernel.org tarball/patch signature files Jari Ruusu
2011-10-23 11:37 ` Greg KH
2011-10-23 14:07 ` Jari Ruusu
2011-10-25 1:49 ` Greg KH
2011-10-25 4:31 ` Kyle Moffett
2011-10-25 8:27 ` H. Peter Anvin
2011-10-25 9:13 ` Valdis.Kletnieks
2011-10-25 9:32 ` H. Peter Anvin
2011-10-25 6:06 ` Jari Ruusu
2011-10-25 7:09 ` Greg KH
2011-10-25 8:09 ` Jari Ruusu
2011-10-25 7:28 ` Valdis.Kletnieks
2011-10-25 7:34 ` Greg KH [this message]
2011-10-24 17:18 ` Valdis.Kletnieks
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20111025073454.GA14967@kroah.com \
--to=greg@kroah.com \
--cc=Valdis.Kletnieks@vt.edu \
--cc=jariruusu@users.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).