0

Having a hard time verifying the trustworthiness of GPGTools. I really want to trust the project as it adds a lot of convenience on macOS, but can’t figure out if I can without spending a lot of time auditing the codebase.

The pinentry-mac git repository, for example, has only a few contributors with no public track record. I’m not insinuating they are bad actors (they are probably awesome), but I live by the motto "don’t trust, verify".

I feel safer using gnupg when installed using brew install gnupg as it's maintained by the core team of GnuPG.

That being said, I’ve hit an edge case with pinentry-curses and people recommend using pinentry-mac.

1

The ways for you to trust software is limited. Essentially, your options boil down to this:

  • Audit it yourself.

    This is time-consuming, requires quite some skill and ultimately requires you to build the software yourself, as you cannot be guaranteed that the compiled binary you download matches the source code you have been provided. But all in all, this is the "most secure" way of doing it.

  • Trust someone who audited it.

    With larger projects, such as GnuPG, you can be reasonably sure that trustworthy people have audited the source code. While this approach has it's limits, it's generally what most people do. I didn't check the source code of the Linux kernel before downloading a Linux distribution, nor did I check the source code of every single package. I assume others did it, and if there was something wrong, I assume they'd tell someone.

  • Just wing it.

    Arguably the least secure approach, but the approach most people go down when they just want to download and run some utility. You have backups, right?

2
  • Thanks for the follow up. I agree with the above but was hoping for a more specific answer in the context of GPGTools.
    – sunknudsen
    Oct 23 '19 at 11:41
  • 1
    Your question was "How can I verify the trustworthiness of this tool?", not "How trustworthy is this tool?" (because that would have been off-topic). The sad truth is, you can't really do anything aside from either doing the wetwork yourself or hoping nothing bad happens.
    – MechMK1
    Oct 23 '19 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.