Re: [Launchpad-users] RFC: PPA support for community-supported architectures

[Karl Fogel <karl.fogel@xxxxxxxxxxxxx>]

Richard Wilbur <richard.wilbur@xxxxxxxxx> writes:
> I am happy to start another thread.  I figured accommodating
> "contributed builds"/"binary uploads" would change the user interface
> design somewhat if it were implemented.  For instance contributed builds
> would benefit from a link to the contributor's PGP signing key as it
> would be different from the PPA key.
>
> While the guarantee that "the source you see is the source that built
> the binary" may not apply to contributed builds, the trust placed in the
> one who uploaded the source code could be extended to binaries uploaded
> by the same person.  In other words, "the person who uploaded the source
> you see is the person that built and uploaded the contributed binary."

Well put.

The difference still needs to be clear to downloaders, of course: a
malicious uploader could post benign source code and a backdoored
binary, and sign them both.

IOW, the point of "the source you see is the source that built the
binary" is to make it so one can inspect the source and thus trust the
binary, without knowing anything else about the author of the source
(the user still has to trust the people running the automatic build
system -- presumably that trust is there, if the user is running Ubuntu
in the first place!).

But being able to at least transfer trust from a source signer to the
resultant binary would still help.

I've linked to this thread in https://bugs.launchpad.net/soyuz/+bug/393407.

Concrete UI suggestions (mockups are best) would do the most to move
this along, I think.  Please feel free ask for help on how to do that:
https://dev.launchpad.net/Help .

-Karl