Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Sukneet Basuta <sukneet AT gmail.com>
  • To: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Thu, 1 Dec 2011 00:03:52 -0500

On Thu, Dec 1, 2011 at 12:10 AM, flux <flux AT sourcemage.org> wrote:
> I should add that my previous post was concerned with upstream signed
> sources. If a source is signed by us, then the signature vs. the hashsum
> are still not technically equivalent, but the signature will bear far
> less weight, making the two practically equivalent (emphasis on
> practically, as in "in practice").
>

Sorry, my question was regarding guru signed verification if it wasn't
clear (specifically the WORKS_FOR_ME verification level). I don't
think there is any argument against the fact that upstream signed
sources are better than hashes. I believe Ladislav was stating that
they are practically equivalent.




Archive powered by MHonArc 2.6.24.

Top of Page