[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-dev] repo: TLS vs. GPG signed files (#12871)
Hi Ondrej,
[I felt it is better to discuss this via email if you feel otherwise
feel free to move the discussion back to trac.]
even though it was also me requesting the use of HTTPS for the repos [1]
- and I'm glad it has been (partially) accepted and implemented I do not
follow your comment that HTTPS is "better" than repo_gpgcheck [2].
It is my opinion that even in the case of HTTPS GPG signatures provide a
security improvement since (I hope) the private GPG key used to sign the
repo is less exposed than the wildcard certificate for *.tpo.
(I filed #13553 [4] to address rogue CAs / certificate pinning for yum.)
Could you elaborate on your issue regarding repo_gpgcheck not showing
fingerprints? (It does show the gpg key fingerprint on a fc20 system
after adding repo_gpgcheck=1 and running 'yum update' [3]).
thanks for providing and maintaining the RPM repo,
Nusenu
[1] https://trac.torproject.org/projects/tor/ticket/12897
[2] https://trac.torproject.org/projects/tor/ticket/12871#comment:8
[3]
Importing GPG key 0x5AC001F1:
Userid : "torproject.org RPM signing key"
Fingerprint: 3b9e eeb9 7b1e 827b cf0a 0d96 8af5 653c 5ac0 01f1
From :
https://deb.torproject.org/torproject.org/rpm/RPM-GPG-KEY-torproject.org.asc
Is this ok [y/N]:
[4] https://trac.torproject.org/projects/tor/ticket/13553
_______________________________________________
tor-dev mailing list
tor-dev@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev