[Starlingx-discuss] Tar Compressed Files: Integrity Verification

[Arce Moreno, Abraham]

One of the inputs for StarlingX build process besides RPMs, comes in the form of Tar Compressed files which gives us the task to verify the package integrity by locating its GPG key file, another layer of security.

We have 2 types of Tar Compressed file sources:

- From official repositories
- From Github repositories

In the case of official repositories, most of packages do not come with asc/dsc GPG key file [0], pushing us to search for a secondary one, just in a few cases so far, that GPG key file is found [1]. Is this a "search" only process? is there any other way to facilitate the search? Is it ok to rely on md5 checksum where no GPG key is found?

In the case of Github repositories, being in a package coming from a Github repository [2] gives us the integrity verification?

Lupita, Abraham

[0] https://fast.dpdk.org/rel/
[1] http://http.debian.net/debian/pool/main/d/dpkg/
[2] https://github.com/voxpupuli/puppet-boolean/tarball/22b726dd78b0a60a224cc7054aebbf28e9306f62
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20180613/4a69705a/attachment.html>