Bug 1368

Summary: Source Certification Contract (SCC)
Product: [JogAmp] General Reporter: Sven Gothel <sgothel>
Component: buildsAssignee: Sven Gothel <sgothel>
Status: IN_PROGRESS ---    
Severity: normal    
Priority: P4    
Version: tbd   
Hardware: All   
OS: all   
Workaround: ---
Bug Depends on: 1369    
Bug Blocks:    

Description Sven Gothel 2019-04-03 05:39:04 CEST
Long term goal implementing SCC as an secure trustworthy alternative
to simply signed jar files.


    Are You Who You Say You Are?

This question doesn't make clear Who is who, or who are we talking about?

When attempting to run a binary object on your system, users need to trust the binary and its original source code.

The question should ask for the authorship of the binary and it's assumed source code, hence SCC authenticates the binary against the source code it claims to be originated from.

SCC answers:

    This binary is produced by this set of source code, which is trusted by these people.

SCC verifies whether a binary object's signature matches its assumed source code signatures.

SCC provides a list of personal signatures who trust this source code, as well as a list of personal signatures who trust this binary object. Hence SCC incorporates a chain of trust. https://en.wikipedia.org/wiki/Chain_of_trust