Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Wed, 31 Aug 2005 23:00:59 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 31 Aug 2005, Sergey A. Lipnevich wrote:
<snip>
I appreciate what you are trying to do Seth, it's very constructive.
It's signing tarballs against my will that will never sit well in my
mind. For example, I used to be a Subversion committer, and I read a lot
of its code. I trust people on the team, and I know all code is being
reviewed, because the make it so. I'd feel very comfortable signing
their tarball. They however already provide such signatures, so my
support is not needed. For packages that don't have signatures, their
authors' level of development culture is probably lower (or they don't
want to deal with signatures), so there's no reason to make these
tarballs appear to be coming from a trusted source.
<snip>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
I think right there is the problem. We're not saying we're a trusted
source. We're only saying that the tarball you, the user, are
receiving is the same as the developer who updated the spell received
and used to test the update.

- -sandalle

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDFpkeHXt9dKjv3WERApRbAJ4s/QyMntnCqccJQO7NfgqfYVZDXgCcCgo/
CGKiBWCDmGqHdhHovGTZfmY=
=h8ua
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page