Hmm... I've been thinking of starting to using Module::Signature on stand alone network, since verifying that the file was written as the author had intendeed is a good thing (tm). (In this case, a network that does not have access to the regular internet.) I would still like to have the ability to verify that the module was written as intended, but since the module makes queries to (a specific key server), how would one implement this? I have a couple of ideas, but I'm not sure which would be best or most feasible...
Update: Autrijus, the author of the module, replied below. He has a good plan and is working with people that run CPAN to address this concern.
Any ideas? If people are interested, I might be able to write some code to support this...
Have a great one.

----
Zak
  • Comment on Module::Signature on stand alone networks

Replies are listed 'Best First'.
My tentative plan is...
by audreyt (Hermit) on Aug 12, 2003 at 16:50 UTC
    • To make Module::Signature fail gracefully (fallback to simple SHA1 check without OpenPGP check) when used in an environment without network connnection. This has been done.
    • Modify PAUSE to allow uploading of PUBKEY (or PUBKEY.txt) to the author's directory. That file is overwritable.
    • PAUSE may also act as a local CA and sign each successfully uploaded PUBKEY. Consequently, individual PUBKEY files can be downloaded via http, rsync, ftp from any CPAN mirrors.
    • It may be desirable to publish the PAUSE keyring as a master file, such as 05pubring.gpg.gz, which contains all PUBKEY files mentioned above.
    • User _may_ choose to trust PAUSE, and by extension marginally trust each author's keys.

    Of course, this is still pending furthur discussion with ANDK and other CPAN workers.

    Thanks,
    /Autrijus/

[reply]
      Audrey,

      Sorry to resurrect an old thread, but what decisions had been made about distributing the module signatures? I've been signing all of my modules, but I don't want the scary "WARNING: This key is not certified with a trusted signature!" warning to appear to everyone installing the module.

      I'm more than willing to exchange signing keys with other authors to help build the trust web, but I'm not sure where to start.

      Currently, I'm going to just add a TEST_SIGNATURE environment variable gate so that the test is just run when requested by users. But I think it would be best in the future (for authors and recipients) if the module is tested every time it's installed.

      Thanks for your time and effort on Module::Signature.

      - Roy
[reply]
Re: Module::Signature on stand alone networks
by PodMaster (Abbot) on Aug 12, 2003 at 11:27 UTC
    I like option#2, that would make a nice addition. Instead of creating another master file (04), maybe extending 01mailrc.txt.gz to include a signature might not be a bad idea (if the signatures aren't too big), either way, I like option #2.

    MJD says "you can't just make shit up and expect the computer to know what you mean, retardo!"
    I run a Win32 PPM repository for perl 5.6.x and 5.8.x -- I take requests (README).
    ** The third rule of perl club is a statement of fact: pod is sexy.

[reply]

Back to Meditations