On Wed, Mar 19, 2014 at 7:21 AM, ajay medury <[email protected]>wrote:
> Hello, > > My name is Ajay Medury, and I am student taking Prof. Germonprez's class > on Open Source Tool Development. My team and I have been working on getting > the SPDX Dashboard up and running and have run into some issues when > considering the online verification (signing) of SPDX documents. > I don't understand the use case. What do you mean with "online verification"? Do you mean someone logging into a web site with OAUTH? And what do you mean with "signing"? Are you talking about signing with a cryptographic key? Overall I don't really understand where you're going with this. Doesn't the BoM need to be generated from the actual hardware target? Otherwise, how do you know it comes from the target? What evidence do you provide that the generated BoM corresponds in a 1 to 1 fashion with the built binary target? In Debian for example you can use debsums which has a cryptographically secure hash sum generated on the binary package which corresponds 1 to 1 with the source package. The source package holds the BoM which is also signed with a strong cryptographic key and hash summed. In the source package is the pristine source code for the binary as well as the BoM which denotes copyright and license for any and all corresponding artifacts. This is the chain of causality if you will and can be displayed on the web, but changing the BoM changes the hash sum and compromises integrity. What is the process for the SPDX dashboard? Does it aim to allow one to generate a BoM from a package online? Cheers, Jeremiah > We were hoping to get the community's help on this matter as we have > discussed three possible alternatives on solving this issue. They are > listed below: > > > 1. Allowing anyone to signoff (verify) an SPDX document after they > enter and confirm their identity (via a conformation email sent to them) in > the form of email ids. Then keep track of all verifications in a sort of > log, which would be recorded in our common database (can answer questions > about this if needed). > > This sounds like a wiki? > > 1. Allow only a preselected group of users to signoff on documents > after they first provide and confirm (same as above) their email id, which > the system will then check to see if this is present in the list of > preselected individuals. All of these signoffs will also be recorded in the > database. > 2. Have a simple login system which has a list of email ids and > passwords stored in the common database, and allows users to login t > signoff on documents. All interactions here, including the login and > signoff will be logged. > > > My team and I greatly the community's input on this matter and look > forward to hearing from you. > > Thank you, > Ajay B. Medury (& Team Dashboard) > > > _______________________________________________ > Spdx-tech mailing list > [email protected] > https://lists.spdx.org/mailman/listinfo/spdx-tech > > -- ============================================= Jeremiah C. Foster GENIVI Community Manager Pelagicore AB Ekelundsgatan 4, 6tr, SE-411 18 Gothenburg, Sweden Mobile: +46 (0)730 93 0506 E-Mail: [email protected] ============================================= === NOTE === The information contained in this E-mail message is intended only for use of the individual or entity named above. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. =============
_______________________________________________ Spdx-tech mailing list [email protected] https://lists.spdx.org/mailman/listinfo/spdx-tech
