[Gllug] Linux Conf GUI

[home at alexhudson.com]

On Thu, Jul 19, 2001 at 05:06:46PM +0100, Chris Ball wrote:
> > dpkg is a little behind, but if it can't do it yet the code is certainly in
> > CVS AFAIK. 
> 
> Sure. The advantage of the Debian Way that hasn't been mentioned, though,
> is that Debian enforce package maintainers to sign packages before they
> enter the main repository

RHN is signed too; as is stuff like RedCarpet (at least, Ximian have the
functionality in their software, I do often see unsigned packages though),
and I would suspect most major distributions have at least some system in
place.

> created the package. This is greatly unlike downloading random rpms. :)

.. but not greatly unlike downloading random debs :)

Seriously though, the whole thing is a web of trust thing anyway - the
ability to sign is useless if you don't have a chain of trust on the
certificate that has been used to sign the package. So by downloading debs,
you automatically include debian into your web of trust. Probably the same
with RedHat. But it wouldn't be that hard to get some of these systems
counter-signed with other major webs. I don't know of any Linux system that
comes with a set of good root certs as standard, but that surely can't be
far off, since the adoption of PKI is not only good but arguably necessary,
and Linux so far doesn't have a great uptake, even compared to systems like
Windows.

> It doesn't guarantee against someone authorised by Debian putting out
> an apt-able trojan; it guarantees that the name on the signature is the
> Real-Life Person who uploaded the package, though.

Exactly. It buys you as much security as your faith in the certificate.

Cheers,

Alex.
-- 

-- 
Gllug mailing list  -  Gllug at linux.co.uk
http://list.ftech.net/mailman/listinfo/gllug