[SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
Sergey A. Lipnevich
sergey at optimaltec.com
Mon Aug 29 17:22:17 EDT 2005
Quoting dave at sourcemage.org:
> I understand that you might have reservations using a personal
> signature. Signing your name is serious business, and not to be done
> lightly. However you are making a logical error in assuming the
> signature itself has some inherent meaning other than repudiating your
> agreement to the stated terms.
>
> Although you will be providing your signature with the tarball, you are not
> signing the tarball. You are signing this:
>
> http://www.sourcemage.org/security-source_integrity_checking_standards
Thanks again, but no, I can't support this. Sorry.
Sergey.
More information about the SM-Discuss
mailing list