News for hackers. Stuff that matters.

A comment on Why Package Signing is not the Holy Grail. Parent comment

Re:Why Package Signing is not the Holy Grail by Daviey on Wednesday July 24, 2013 @03:39AM (#6094937)
Hmm, with Ubuntu, there is not a required web-of-trust, as the uploader merely adds their key to their account using Launchpad.

If the user was able to access their Launchpad account, there is implicit trust.

There isn't a Ubuntu shared keyring for each developer/maintainer, as there is with Debian - rather, a handful of shared keys, where the secret is only held by the infra. These are currently, Apt Archive, CD image & now Ubuntu Cloud Archive.

[ Parent | on HN ]
Re:Why Package Signing is not the Holy Grail by rlpb on Wednesday July 24, 2013 @05:04AM (#6095120)
But Launchpad accounts only get upload rights when their prior work is reviewed by the developer membership board. And the prior work is identified against that same Launchpad account. So there is a root of trust: it's the developer membership board. It just happens that the trust system isn't implemented using a PGP web of trust directly.
[ Parent | on HN ]