taskSavannah Administration - Tasks: task #5188, Submission of X.509 Cert


task #5188: Submission of X.509 Cert

Submitted by:  -Deleted Account- <fasten>
Submitted on:  Mon 23 Jan 2006 01:05:34 PM UTC  
Should Start On:  Sun 22 Jan 2006 11:00:00 PM UTC Should be Finished on:  Wed 01 Feb 2006 11:00:00 PM UTC
Category:  Project Approval Priority:  5 - Normal
Status:  Done Privacy:  Public
Percent Complete:  0% Assigned to:  Sylvain Beucler <Beuc>
Open/Closed:  Closed Effort:  0.00

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


( Jump to the original submission)

Wed 19 Jul 2006 10:32:08 PM UTC, comment #10:

(/me is ploughing through mail backlog...)

"Is it possible to rename the project to xcert? I don't really know where the sw in the name came from. The intended name was just 'cert'. 'swcert' is, IMHO, not a particularly good name."

Do you still want your project renamed? If yes, please post a support request and we'll take care of it.

Sylvain Beucler <Beuc>In charge of this item.
Sat 10 Jun 2006 09:29:29 AM UTC, comment #9:

Is it possible to rename the project to xcert? I don't really know where the sw in the name came from. The intended name was just 'cert'. 'swcert' is, IMHO, not a particularly good name.

-Deleted Account- <fasten>
Sun 26 Feb 2006 05:11:17 PM UTC, comment #8:

I approved your project.

When you upload your documentation remember to follow the GFDL howto :) (copyright and license notices)

Sylvain Beucler <Beuc>In charge of this item.
Fri 17 Feb 2006 09:42:51 AM UTC, comment #7:

There is no intention to mirror an SF project. If I create a similar project on SF the savannah project will be the prototype but the SF project will be a CA primarily to SF-hosted projects and the savannah project primarily to savannah-hosted projects.

There is not yet any software or documentation. The first step should probably be a design phase to decide what software needs to be written and what the initial democratic process could be like.

-Deleted Account- <fasten>
Thu 16 Feb 2006 09:42:04 PM UTC, comment #6:


If you plan to host the project on SF as well, beware that Savannah won't accept to become a mirror of it :)

Do you happen to have existing material (documentation or software) that I could review for legal issues / proper legalese?

Sylvain Beucler <Beuc>In charge of this item.
Wed 15 Feb 2006 12:17:25 PM UTC, comment #5:

I think the project could be easily hosted on sourceforge.net,
only I prefer to have it hosted on savannah. A sister project on
sourceforge may be a second step if this one proves to be
useful in community building and in motivating people to
build a web of trust for code certification.
Yes, I am still interested in this project account.

-Deleted Account- <fasten>
Tue 14 Feb 2006 11:30:55 PM UTC, comment #4:

Sorry for this huge delay - I got pretty busy with other issues during the last month :/ (not that it's an acceptable excuse..)

Did you find another host meanwhile, or are you still interested in this project account?

Sylvain Beucler <Beuc>In charge of this item.
Tue 24 Jan 2006 09:37:18 AM UTC, comment #3:

Did I mention the ticket system? The ticket system is obviously very useful for a certification authority that is listening for complaints in order to revoke certificates. It can also serve the same purpose as a wikipedia talk page, only more orderly. There may be some applications where a wiki could be desirable, e.g. for the collaborative editing of policy documents, but this can also happen on the webcvs with similar effect.

-Deleted Account- <fasten>
Tue 24 Jan 2006 09:30:20 AM UTC, comment #2:

Savannah offers a webpage as the access point for CRLs and RSS news, a mailing list to organize the members of the project, CVS to maintain the software (a certain amount of software development might be required, e.g. a program that checks OpenPGP keys and analyses the web of trust) and a secure environment: The use of ssh keys for CVS appears more secure than e.g. sourceforge.org. I also suspect that the projects hosted on savannah are a smaller but more  interesting clientele than e.g. sourceforge.org.
The documentation license would apply to software review policies developed by the project. A reviewer who vouches for the fitness of a software for a specific purpose would be able to specify what review policy has been used to verify the claim and then sign a document that associates the review policy (by URL) with the software.
The latter signature should probably use OpenPGP so everybody would be able to verify what amount and what kind of peer review has been given to what release of a program.

-Deleted Account- <fasten>
Mon 23 Jan 2006 08:32:18 PM UTC, comment #1:


Can you detail how Savannah will help your project?
(we usually host software or documentation projects)

Also, what do you intend to place under the GNU Free Documentation License?

Sylvain Beucler <Beuc>In charge of this item.
Mon 23 Jan 2006 01:05:34 PM UTC, original submission:

A new project has been registered at Savannah
The project account will remain inactive until a site admin approve or discard the registration.


While this item will be useful to track the registration process, approving or discarding the registration must be done using the specific "Group Administration" page, accessible only to site administrators, effectively logged as site administrators (superuser):


######### REGISTRATION DETAILS #########

Full Name:
  X.509 Cert

System Group Name:

  non-GNU software & documentation

  GNU Free Documentation License

  A community operated X.509 CA for software certification. The Root CA will allow interested software projects to become second level CAs. The project itself will primarily release a key revocation list. The main goal is to have a CA that allows to sign free software for free and can be expected to act responsibly when certificates need to be revoked.
A secondary goal is to release code review policies and allow peer review of free software to be categorized according to the type of review that a piece of software was subjected to. In order for X.509 certificates to be issued a project's CA operator would need to join this projects and participate in the community. In a secondary step the project CA operator would need to issue a dedicated OpenPGP key and receive at least 20 signature with a sufficient trust ranking to be allowed to operate a project CA with a key signed by the Root CA.
A democratic process within the project would then designate administrators who can generate project CA certificates and revoke them.
The development of policies could happen in a Wiki with the administrators as wiki administrators.

Other Software Required:
  A free X.509 CA tool.

Other Comments:
  This is a CA for the exclusive purpose of software certification and verification. The Root CA may become a second level CA of http://www.cacert.org/ but as cacert.org is not a community for software certification it can not be replaced by a cacert.org certificate. The community must be able to reply to software security incidents, hence the name 'cert' (as in computer emergency reponse team).

-Deleted Account- <fasten>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #3798:  initial_process.html added by fasten (5KiB - text/html - initial process)


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


Do you think this task is very important?
If so, you can add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.




Follow 5 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2006-02-26 Beuc StatusWait reply => Done
    Open/ClosedOpen => Closed
2006-02-17 fasten Attached File- => Added initial_process.html, #415
2006-01-23 Beuc StatusNone => Wait reply
    Assigned toNone => Beuc

Back to the top

Powered by Savane 3.4