On 06/19/2014 10:37 AM, Dag Wieers wrote:
On Wed, 18 Jun 2014, Lamar Owen wrote:
So, somewhat paradoxically, I would have a greater confidence in
source from git than source from a signed source RPM, again due to
git's design. ...
It depends of course who signs it.
First, Dag, it's good to hear from you again. Glad to see you're still
around, and glad to see some update activity of late. You have a great
perspective on all of this, having run a major third-party repo for
years, and I appreciate your input in the discussion.
Secondly, I'll qualify your statement by doing a s/who/which signing
key/g on it. Any given entity may have multiple signing keys, and
unless one has a subscription one cannot know that the public sources
are signed with the same key that has signed the sources available with
the subscription (to the best of my knowledge the public source RPM's
are the same, but I have not personally checksummed all of the EL6
source RPMS available publicly and compared against what's available by
subscription).
If the SRPM is signed by Red Hat, and the git commits are signed by
CentOS, you cannot really say that it is the same thing. One may claim
that it is the same thing, but only Red Hat can prove it for every
commit/SRPM.
Red Hat has confirmed in a public bugzilla comment (
https://bugzilla.redhat.com/show_bug.cgi?id=1109401#c13 ) that they are
populating the git repos. Yes, I would prefer it show as 'Red Hat
Buildsys' and be signed as being from Red Hat, too.
And that is a problem.
I agree that there is a problem, at least from one point of view. My
take on it is that if you need the chain of trust to be that tight you
need to pony up a subscription and get RHEL, because even with a good
chain of trust for the source there are other problems. I won't speak
for other points of view. To date, the level of trust I have in both SL
and in CentOS is pretty high and I use both; but if I had to pass a cert
of some sort (PCI or similar), or I were to need to handle sensitive
information (HIPAA or similar), I would budget for RHEL for that
application.
Your chain of trust becomes one piece longer, and we don't know what
that piece exactly entails.
No, we don't. So I'm watching the process to see how things are going,
and make my own decisions accordingly. But I remember when rebuilding a
Red Hat Linux from source required a really heavily modified system
running something similar to beehive; we've come a long way.
It's always good to hear your perspective, Dag, and I hope you have a
great day.
