Closed marcusva closed 7 years ago
Original comment by Franz Schrober (Bitbucket: franzschrober, GitHub: Unknown):
Not very much? When the distribution always checks against the same key before downloading a source.... I bet it helps a lot to identify the source of the tarball with a high probability. At least it would helped a lot in the past:
Original comment by Franz Schrober (Bitbucket: franzschrober, GitHub: Unknown):
Most of the stuff is described in the links. Here is another post about how it is done. https://groups.google.com/d/msg/mupen64plus/FgXPLOMgGBE/rgv9rjotXFwJ
This cannot be solved by you because you are not the maintainer/release manager and the maintainer/release manager should do the signing.
What needs to be done:
And as extra step the signer of the keys must be reachable using the mail address to make a simple verification that the signature key belongs to the mail address.
Originally reported by: Franz Schrober (Bitbucket: franzschrober, GitHub: Unknown)
Distributions now try to verify upstream tarballs to easier detect manipulation by third parties. One of the steps is to have detached, ascii armored signatures done using the PGP/GnuPG signature key of the software author next to the actual source tarball.
Of course, this is only one check but at least this one can help: http://lists.opensuse.org/opensuse-factory/2012-12/msg00235.html https://wiki.debian.org/debian/watch/#Cryptographic_signature_verification