Bryans pgp

[hasufell]

@bgamari @wz1000

Related: haskell/ghcup-hs#889

[hasufell]

@chreekat any progress with the cross signing?

[hasufell]

It seems there's no progress/interest. Thus I'm closing this.

[chreekat]

Reopening because I am, in fact, interested. No visible progress was caused by having other priorities and no clear understanding of deadline here. If you do want to specify a deadline, please do so :)

[chreekat]

Well, I just spent an hour getting back up to speed on how PGP works. Then I spent another 15 minutes trying to explain why I'm not convinced it's a good use of my time.

But maybe I don't need to try to convince anybody of anything.

Suffice to say, I don't think it's a good use of my time, so I will indeed close this issue. I'm open to hearing explanations why signing the metadata is important or how cross-signing the keys without in-person confirmation of fingerprints adds any value, but until then...

Oh, another thing: What rights and responsibilities would come with having my key in the list of allowed keys? I sorta thought it was just to allow me to sign my own contributions if I were to do another GHC release at some point. Was that correct?

[hasufell]

I'm open to hearing explanations why signing the metadata is important

Because nothing guarantees the authenticity. HTTPS does not. Github does not, haskells download server does not.

That's why GHC developers sign all bindists, that's why distributions use pgp keysigning for their metadata (check gentoo etc.). The security propagates through the implicitly signed SHA256 hashes.

or how cross-signing the keys without in-person confirmation of fingerprints adds any value, but until then...

We can do in-person cross signing at Zurihac.

What rights and responsibilities would come with having my key in the list of allowed keys?

It means unless you provide the required steps wrt pgp, you don't have write access to this repo, but will have to go through Ben or Zubin when doing post release steps that involve ghcup. That is not negotiable.

Feel free to ask/discuss with the security response team. An issue was opened here: haskell/ghcup-hs#858

[chreekat]

Because nothing guarantees the authenticity. HTTPS does not. Github does not, haskells download server does not.

My concern is that I don't trust the rest of the system to generate something worth authenticating with PGP. Not that I think there's any glaring holes in the system. I just worry it gives a false sense of security at the high cost of making automation harder.

But ok, I'll drop that for now. I'm still willing to get added, however. I assume you still want to wait for cross-signing first? I'm more than happy to do an in-person cross-signing some time. A video call would also be fine for me since I've met all of you in person.

[hasufell]

I just worry it gives a false sense of security at the high cost of making automation harder.

Automation isn't the primary concern of redistribution, IMO.

Also note my comments in the docs: https://www.haskell.org/ghcup/guide/#gpg-verification

Then verify the gpg key in one of these ways:

1. find out where I live and visit me to do offline key signing
2. figure out my mobile phone number and call me to verify the fingerprint
3. more boring: contact me on Libera IRC (maerwald) and verify the fingerprint

So far, no one has contacted me. But that's irrelevant. The docs make clear how to do it properly. It's a sign that GHCup takes security seriously, even if no one makes use of it.

If there's a better system, that doesn't require building offline trust, please point me to it. But I don't think there is.

I assume you still want to wait for cross-signing first?

Yes.

I'm more than happy to do an in-person cross-signing some time. A video call would also be fine for me since I've met all of you in person.

You think a video call is enough in light of recent developments in AI? 🤔

[chreekat]

You think a video call is enough in light of recent developments in AI? 🤔

Lol, good point :P

[chreekat]

I'll cross-sign my key with any other Zurihac attendees who are in the file (@bgamari , @Kleidukos , @wz1000 ?)