SCC Overview - Revision history

Sgothel at 15:31, 12 September 2013

2013-09-12T15:31:59Z

← Older revision		Revision as of 17:31, 12 September 2013
Line 42:		Line 42:

	== Motivation ==		== Motivation ==

			''SCC'' was conceived in [{{SERVER}}/log/irc/jogamp_20130912050611.html#l8 this discussion in our IRC channel, 2013-09-12].

	=== What's wrong with current binary distribution models? ===		=== What's wrong with current binary distribution models? ===

2013-09-12T15:13:21Z

Design

← Older revision		Revision as of 17:13, 12 September 2013
Line 71:		Line 71:
	Each tag has a unique cryptographic signature, either providing a hash value over source code or binary objects.		Each tag has a unique cryptographic signature, either providing a hash value over source code or binary objects.

	Source and binary tags are stored in an accessible source code ~~repository~~ (SCR).		Source and binary tags are stored in an accessible source code repositories (SCR).

	The source tag is provided at build time.		The source tag is provided at build time.

2013-09-12T15:07:29Z

Design

← Older revision		Revision as of 17:07, 12 September 2013
Line 84:		Line 84:
	Developers may associate their personal signature to the binary tags '''if''' they trust its code and build.		Developers may associate their personal signature to the binary tags '''if''' they trust its code and build.

	''Auth-1'': ''SCC'' validates the binary ~~with~~ its tag and whether both tags exist in the SCR and are equal.		''Auth-1'': ''SCC'' validates the binary against its tag and whether both tags exist in the SCR and are equal.

	''Auth-2'': ''SCC'' may show personal signatures associate to the source and binary tags,		''Auth-2'': ''SCC'' may show personal signatures associate to the source and binary tags,

2013-09-12T15:07:11Z

Design

← Older revision		Revision as of 17:07, 12 September 2013
Line 84:		Line 84:
	Developers may associate their personal signature to the binary tags '''if''' they trust its code and build.		Developers may associate their personal signature to the binary tags '''if''' they trust its code and build.

	''Auth-1'': ''SCC'' validates whether both tags exist in the SCR and ~~whether they~~ are equal.		''Auth-1'': ''SCC'' validates the binary with its tag and whether both tags exist in the SCR and are equal.

	''Auth-2'': ''SCC'' may show personal signatures associate to the source and binary tags,		''Auth-2'': ''SCC'' may show personal signatures associate to the source and binary tags,

2013-09-12T14:56:48Z

Revocation

← Older revision		Revision as of 16:56, 12 September 2013
Line 91:		Line 91:
	=== Revocation ===		=== Revocation ===

	Revocation of single binary tag ~~are~~ possible by simply removing		Revocation of a single binary tag is possible by simply removing
	a binary tag from the SCR.		the binary tag from the SCR.

2013-09-12T14:47:32Z

Design

← Older revision		Revision as of 16:47, 12 September 2013
Line 69:		Line 69:
	== Design ==		== Design ==

	Each tag has a unique cryptographic hash ~~signature~~.		Each tag has a unique cryptographic signature, either providing a hash value over source code or binary objects.

	Source and binary tags are stored in an accessible source code repository (SCR).		Source and binary tags are stored in an accessible source code repository (SCR).

2013-09-12T14:46:12Z

Revocation

← Older revision		Revision as of 16:46, 12 September 2013
Line 91:		Line 91:
	=== Revocation ===		=== Revocation ===

	Revocation of single binary ~~signatures~~ are possible by simply removing		Revocation of single binary tag are possible by simply removing
	a binary ~~signature~~ from the SCR.		a binary tag from the SCR.

2013-09-12T14:45:15Z

Design

← Older revision		Revision as of 16:45, 12 September 2013
Line 84:		Line 84:
	Developers may associate their personal signature to the binary tags '''if''' they trust its code and build.		Developers may associate their personal signature to the binary tags '''if''' they trust its code and build.

	SCC validates whether both tags exist in the SCR and whether they are equal.		''Auth-1'': ''SCC'' validates whether both tags exist in the SCR and whether they are equal.

	SCC may show personal signatures associate to the source and binary tags,		''Auth-2'': ''SCC'' may show personal signatures associate to the source and binary tags,
	allowing the user to make a choice based on the [https://en.wikipedia.org/wiki/Chain_of_trust chain of trust].		allowing the user to make a choice based on the [https://en.wikipedia.org/wiki/Chain_of_trust chain of trust].

2013-09-12T14:43:22Z

Design

← Older revision		Revision as of 16:43, 12 September 2013
Line 86:		Line 86:
	SCC validates whether both tags exist in the SCR and whether they are equal.		SCC validates whether both tags exist in the SCR and whether they are equal.

	SCC may show ~~personal~~ personal signatures associate to the source and binary tags,		SCC may show personal signatures associate to the source and binary tags,
	allowing the user to make a choice based on the [https://en.wikipedia.org/wiki/Chain_of_trust chain of trust].		allowing the user to make a choice based on the [https://en.wikipedia.org/wiki/Chain_of_trust chain of trust].

2013-09-12T14:42:03Z

Design

← Older revision		Revision as of 16:42, 12 September 2013
Line 82:		Line 82:
	Developers may associate their personal signature to the source tag '''if''' they trust its code.		Developers may associate their personal signature to the source tag '''if''' they trust its code.

	Developers may associate their personal signature to the binary tags '''if''' they trust its code.		Developers may associate their personal signature to the binary tags '''if''' they trust its code and build.

	SCC validates whether both tags exist in the SCR and whether they are equal.		SCC validates whether both tags exist in the SCR and whether they are equal.