[SM-Discuss] GPG verification
sukneet at gmail.com
Wed Nov 30 23:12:10 EST 2011
Ladislav Hagara stated to me that sha512 is equivalent to gpg
verification, implying there is no reason to switch one to the other.
I suppose this does make sense if it is not vendor signed. However,
that everything should be switched over to gpg verification. Ladislav
never responded to my reply below, so I decided I'd ask here.
Should I not be converting spells that already have sha512 hashes to
I noticed that quite a few spells have SOURCE_GPG commented out and
instead have SOURCE_HASH. This seems to go against the wiki document I
linked to above, granted that document is pretty old. So what is the
official stance on this? Or does it ultimately not matter?
---------- Forwarded message ----------
From: Sukneet Basuta <sukneet at sourcemage.org>
Date: Sun, Nov 20, 2011 at 3:15 PM
Subject: Re: [SM-Commit] GIT changes to master grimoire by Sukneet
To: Ladislav Hagara <ladislav.hagara at unob.cz>
Cc: "sm-commit at lists.ibiblio.org" <sm-commit at lists.ibiblio.org>
On Sun, Nov 20, 2011 at 10:06 AM, Ladislav Hagara
<ladislav.hagara at unob.cz> wrote:
>> Why sha512 to gpg verification? They are equivalent.
>> And according to http://wiki.sourcemage.org/HISTORY there is no reason
>> to mention it in HISTORY.
I was under the impression that GPG verification is better than hash
verification, but thinking about it, unless its vendor signed, they
are probably equal.
that all spells should be moved to GPG verification. It also states
" The following are not valid bugs yet, but may be in the future:
Spells which use SOURCE_HASH instead of SOURCE_GPG."
I figured we may as well start moving them over now if they do
eventually become bugs. Although, it looks like I've been ignoring
putting in the verification level.
Should I not bother switching things over to GPG verification?
I've been mentioning it in HISTORY because I think its a good idea to
mention any changes should things like this occur.
More information about the SM-Discuss