[SM-Discuss] GPG verification
Sukneet Basuta
sukneet at gmail.com
Wed Nov 30 23:12:10 EST 2011
Ladislav Hagara stated to me that sha512 is equivalent to gpg
verification, implying there is no reason to switch one to the other.
I suppose this does make sense if it is not vendor signed. However,
http://wiki.sourcemage.org/Source_Integrity_Checking_Standards states
that everything should be switched over to gpg verification. Ladislav
never responded to my reply below, so I decided I'd ask here.
Should I not be converting spells that already have sha512 hashes to
gpg verification?
I noticed that quite a few spells have SOURCE_GPG commented out and
instead have SOURCE_HASH. This seems to go against the wiki document I
linked to above, granted that document is pretty old. So what is the
official stance on this? Or does it ultimately not matter?
---------- Forwarded message ----------
From: Sukneet Basuta <sukneet at sourcemage.org>
Date: Sun, Nov 20, 2011 at 3:15 PM
Subject: Re: [SM-Commit] GIT changes to master grimoire by Sukneet
Basuta (c89a58ac4be591aed17298ed63d5884aad0c997e)
To: Ladislav Hagara <ladislav.hagara at unob.cz>
Cc: "sm-commit at lists.ibiblio.org" <sm-commit at lists.ibiblio.org>
On Sun, Nov 20, 2011 at 10:06 AM, Ladislav Hagara
<ladislav.hagara at unob.cz> wrote:
>> Why sha512 to gpg verification? They are equivalent.
>> And according to http://wiki.sourcemage.org/HISTORY there is no reason
>> to mention it in HISTORY.
I was under the impression that GPG verification is better than hash
verification, but thinking about it, unless its vendor signed, they
are probably equal.
http://wiki.sourcemage.org/Source_Integrity_Checking_Standards states
that all spells should be moved to GPG verification. It also states
" The following are not valid bugs yet, but may be in the future:
Spells which use SOURCE_HASH instead of SOURCE_GPG."
I figured we may as well start moving them over now if they do
eventually become bugs. Although, it looks like I've been ignoring
putting in the verification level.
Should I not bother switching things over to GPG verification?
I've been mentioning it in HISTORY because I think its a good idea to
mention any changes should things like this occur.
More information about the SM-Discuss
mailing list