Re: HEADS UP: Source File Verification

Petr Pisar wrote: https://pagure.io/packaging-committee/issue/610 This objection is answered in the policy itself: “Although a checksum in the sources file certifies that a file retreived from the lookaside cache is the one that the packager uploaded, it is silent on whether the file is what the upstream project released. A signature by the upstream developers certifies that the source is identical to what they released. Verifying the signature as part of the build ensures that packagers don’t forget to verify it.” The syntax is designed to be easy to remember and self-explanatory to the reader. Everyone who reads that would have to already know that the numbers are source file numbers. Otherwise they won't understand what “2 1 0” means. Packagers who are supposed to write it would have to look up the order of the parameters every time. Named parameters can be given in any order. An RPM spec is not a place for golfing. Readable code takes priority over saving keystrokes. As you can see in the ticket, there was an attempt to make it fully automatic, which was abandoned. This is technically true, and doing that obviously works, though it takes more of what you called “boiler-plate code”. In practice, I doubt many upstream projects sign their code that way. It's a bad idea because it unnecessarily exposes the decompression program to untrusted input. If what you package is not what upstream released, then obviously you can't verify it against upstream's signature. If you must remove something for legal reasons, and you still want to verify the tarball, then you can sign your modified tarball with your own key. Björn Persson