keybase / keybase/keybase-issues

Abbreviation of presets in code signing

Open
#746 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

Perhaps it would be better if presets for code signing (`dropbox`, `git`, etc) were included as is, i.e. as a list of ignored files/directories/patterns.

Right now most information required to verify is contained in the SIGNED.md file itself, but not the ignored files (only a preset string representing them).

Two possible complications:
1. Dropbox ignored files may change, as Dropbox et. al. evolves. The preset may become outdated, but it would not be obvious from the signed file.
2. Writing a script (or another client) to verify files require the clients to agree on which files are ignored based on a given present string.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with SIGNED.md and the current code-signing preset representation, then trace how ignored files and directories are selected and recorded. Compare the Dropbox and Git presets and determine what signed output an independent verifier would need; done means the ignored paths are explicit and preset changes are visible.

Written by the indexing model from the issue text.

Assessment

Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.