Re: Re: Best practices for signature verifcation

[Eli Schwartz <eschwartz () gentoo org>]

Hi,

On 12/30/25 7:27 PM, Ali Polatel wrote:

> My initial goal is to switch signing Syd binary releases from gpg to
> signify. Next intention is to consider signing package manifests on
> Exherbo Linux distribution with it. If my memory serves me right,
> Gentoo Linux and Portage has support for GPG signed manifests and
> it has been a longstanding issue in Exherbo Linux how we want to
> do manifests. Current consensus is to use thin package manifests
> on a best-effort basis because we lack the developer time to go
> all in. Thin manifests store a single checksum and package size
> of the relevant package distfiles. My goal/dream is to integrate
> signify into this workflow and start signing thin manifests using
> signify.


If the Exherbo Linux distribution lacks enough manpower to include
checksums (which catch network errors, bitrot, and other forms of
corruption) even though other distros (including Gentoo) simply require
them and autocreate them,

then I cannot help but wonder who is going to go one step further and
also signify-sign the thin manifests that don't exist.


For context, Gentoo / portage requires Manifests, but not that they be
signed. git commit --gpg-sign is used as developer policy for the main
repos, and release infrastructure verifies those signed commits and when
exporting to an rsync tree, produces "GPG signed Manifests" (fat signed).

Checksumming your software downloads is not something that does (or
should?) require "developer time to go all in". It is basic
error-correction so you can detect malformed files and redownload. Your
tooling should simply do it for you.

It is also of course security-relevant as it provides Trust On First
Use. But it's not *only* for people who care about security.


-- 
Eli Schwartz

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature