Differential D4828
Add keys to source package Authored by jasonbcox on Jan 4 2020, 01:20.
Details
contrib/gitian-signing contains the fingerprints of the release signing keys as well as a script to check/refresh those keys. Inspired by https://reviews.bitcoinabc.org/D4807#116075 ninja package_source tar -xzvf bitcoin-abc-0.20.10.tar.gz ls bitcoin-abc-0.20.10/contrib/gitian-signing # verify files are part of the source package
Diff Detail
Event TimelineComment Actions Distributing the keys to verify the authenticity and integrity of a package as part of the package makes the whole procedure pointless. Comment Actions While true on the surface, this is not about providing a process for verifying the integrity of a given source package using the keys inside that same package. The intent is to provide versioned keys to users so they can begin to verify downloads from us. Not doing so is an unnecessary hinderance on UX for first-time key importers. Once a user has the keys, they are no longer reliant on the content of the keys file for anything other than updates to the keys. But since they already have a copy of the keys from a previous release, they'll be able to verify that changes to the keys are legit. Comment Actions I agree with that rationale, in short "if you have any trusted copy of ABC, it contains the keys to verify any new version". However it seems it might make more sense to have the keys as part of the repo itself, no? Then the keys will also be accessible on e.g., github. Edit: Oh I see, the key IDs are in the repo indeed -- contrib/gitian-signing/keys.txt |