Re:Why Package Signing is not the Holy Grail
by lifeisstillgood on Wednesday July 24, 2013 @05:58AM
(#6095251)
The more I think about this the more confused I become
- the obvious first step is for pypy to generate a nonce for each upload request. If that is stored on the original developers source repo then we know that they control that repo. And ?
- send the nonce via a side channel - say email. Ok the owner of the repo also has access to that email. Which is slightly more helpful
But each turn I take I ask myself what am I trying to trust? That the code is not malicious? That's a third party test process. Who will do that?
- the obvious first step is for pypy to generate a nonce for each upload request. If that is stored on the original developers source repo then we know that they control that repo. And ?
- send the nonce via a side channel - say email. Ok the owner of the repo also has access to that email. Which is slightly more helpful
But each turn I take I ask myself what am I trying to trust? That the code is not malicious? That's a third party test process. Who will do that?
So firstly ask the right question ...