[SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

Sergey A. Lipnevich sergey at optimaltec.com
Mon Aug 29 17:22:17 EDT 2005


Quoting dave at sourcemage.org:

> I understand that you might have reservations using a personal
> signature. Signing your name is serious business, and not to be done
> lightly. However you are making a logical error in assuming the
> signature itself has some inherent meaning other than repudiating your
> agreement to the stated terms.
>
> Although you will be providing your signature with the tarball, you are not
> signing the tarball. You are signing this:
>
> http://www.sourcemage.org/security-source_integrity_checking_standards


Thanks again, but no, I can't support this. Sorry.

Sergey.




More information about the SM-Discuss mailing list