Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Mon, 05 Sep 2005 12:51:54 +0200

Yep I like this idea. Why not always using a hash, and adding vendor signing when it's available ?


My kindred spirit. :-)

Personally I would ban smgl's developers gpg signs. There are/will be only problems with them.
I would like us to use only hashes (probably created by gpg --print-md).
Of course "adding vendor signing when it's available" is great for our users.

I would like to see:
# cast xyz
Checking xyz's developers gpg signing .... OK.
Checking Source Mage hash ... OK
...

BTW,
What is the result of our discussion? What is the result of GPG signing poll?

--
lace





Archive powered by MHonArc 2.6.24.

Top of Page