ammachado commented on PR #24682: URL: https://github.com/apache/camel/pull/24682#issuecomment-4992090941
@oscerd on the detached `.asc` idea: agreed it would raise the bar, and I'd like to get there, but I left it out of this PR on purpose. The integrity model here already doesn't come down to a single host. The checksum manifest comes from `camel.apache.org` and the archive from Maven Central, so forging an install means compromising both at once, not either one alone. A `.asc` check would move the anchor from "two independent hosts" to "the offline release key", which is better, but it's an increment on a design that's already two-host-safe, not a missing guard. The cost is a hard `gpg` dependency on the user side, and it lands unevenly. Most POSIX systems have `gpg`; Windows ships no OpenPGP at all, and PowerShell/.NET has no native PGP either, so `install.ps1` users would need Gpg4win. Requiring it breaks the Windows path, and "verify if gpg is present, warn if not" is weak enough that an attacker who can swap the archive can usually make `gpg` look absent too. I'd rather not ship verification that silently no-ops on the platform least likely to have the tool. So my plan is to keep this PR as-is and track `.asc` verification as a follow-up, gated behind an explicit opt-in once the gpg dependency and Windows guidance are settled. Does that split work for you? _Claude Code on behalf of @ammachado_ _**Heads up:** This was co-written with an AI assistant. It's pretty smart, but it can still make mistakes; so please verify any advice before you run with it!_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
