Re: kernel.org tarball/patch signature files

[Greg KH]

On Tue, Oct 25, 2011 at 03:28:37AM -0400, Valdis.Kletnieks@xxxxxx wrote:
> On Tue, 25 Oct 2011 03:49:11 +0200, Greg KH said:
> 
> > The real check, to verify that this tarball really came from "me" should
> > be done on the uncompressed tarball, which is what I can sign, and it is
> > something that you, or anyone else, can reliable duplicate on their own
> > by just using git and not even downloading the tarball at all.
> 
> I'm OK on that part..
> 
> > In other words, we just saved you a MASSIVE bandwidth transation for all
> > of your future kernel downloads, and you can reliable know that the
> > tarball you have in your system is what is on the kernel.org servers
> > without you even having to download it yourself and run those
> > decompression tools that you don't trus.
> 
> If you're building an automated process that will take a just-uploaded foo.tar
> and generate foo.tar.{bz2,gz,foozip}, can you add a step that would just do an
> 'md5sum foo.tar.* > foo.tar.sums'?  Or sha256sum if you're worried about the
> crypto weakness issues with MD5. Personally, I'm more interested in the "Did  I
> hit a network error that the TCP checksum didn't catch?" case.

Yes, we are working on just that thing, and the foo.tar.sums file will
be signed with the kernel.org "throwaway" key, so you can check that as
well.

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/