Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Thu, 8 Sep 2005 11:09:20 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 5 Sep 2005, Ladislav Hagara wrote:
Yep I like this idea. Why not always using a hash, and adding vendor
signing when it's available ?

Please re-read the thread and you'll know why.

My kindred spirit. :-)

Personally I would ban smgl's developers gpg signs. There are/will be
only problems with them.
I would like us to use only hashes (probably created by gpg --print-md).
Of course "adding vendor signing when it's available" is great for our
users.

We're not banning the better technological approach, but, after the
poll I conducted, we are going to continue to support hashsums for the
foreseeable future with `gpg --print-md`.

I would like to see:
# cast xyz
Checking xyz's developers gpg signing .... OK.
Checking Source Mage hash ... OK
...

Why not just one?

BTW,
What is the result of our discussion? What is the result of GPG signing
poll?

Whoops, I responded as I read, sorry. Answer is above. ;)

Short answer: We will continue to support hashsums as well as GPG.

- -sandalle

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDIH5UHXt9dKjv3WERAtZwAJ9ofcRsnhZo/5hbQtpyW3i4tiOdEwCgr057
v7jkupM64NME9u8UprDezYQ=
=fhb5
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page