Bug 1368

Summary:	Source Certification Contract (SCC)
Product:	[JogAmp] General	Reporter:	Sven Gothel <sgothel>
Component:	builds	Assignee:	Sven Gothel <sgothel>
Status:	IN_PROGRESS ---
Severity:	normal
Priority:	P4
Version:	tbd
Hardware:	All
OS:	all
Type:	FEATURE	SCM Refs:
Workaround:	---
Bug Depends on:	1369
Bug Blocks:

Description Sven Gothel 2019-04-03 05:39:04 CEST

Long term goal implementing SCC as an secure trustworthy alternative
to simply signed jar files.

https://jogamp.org/wiki/index.php/SCC_Overview

    Are You Who You Say You Are?

This question doesn't make clear Who is who, or who are we talking about?

When attempting to run a binary object on your system, users need to trust the binary and its original source code.

The question should ask for the authorship of the binary and it's assumed source code, hence SCC authenticates the binary against the source code it claims to be originated from.

SCC answers:

    This binary is produced by this set of source code, which is trusted by these people.

SCC verifies whether a binary object's signature matches its assumed source code signatures.

SCC provides a list of personal signatures who trust this source code, as well as a list of personal signatures who trust this binary object. Hence SCC incorporates a chain of trust. https://en.wikipedia.org/wiki/Chain_of_trust