Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Bor Kraljič <pyrobor AT ver.si>
  • To: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Thu, 01 Dec 2011 16:32:29 +0100

GPG upstream vs GPG SMGL.

As stated in previous mail, the discussion about GPG upstream was on this ML
not long ago [1]. But unfortunately we didn't come to any final conclusion.
The
best solutions was flux idea about adding hashsum for signatures.

However I don't see the benefit in such solution. In Sorcery we have check
that
fails if any of the sources fail the verification. So adding hashsum for
signature would be pretty much the same as having hashsum for main source.

The main question is: Will WE vouch for the sources or the UPSTREAM?
a) WE. Then we should remove all upstream signatures and add hashsum or
developer signature.
b) UPSTREAM. Use pure (without any hashsum of singatures) upstream signatures
and fallback to using developers signature or hashsum if upstream signatures
are not available. This is pretty much the way it is now described in our
Source Integrity Checking Standards [2].



SOURCE_HASH vs GPG SMGL.

I usually use the same method as it was previously used in spell. I try not
change the method. However that is only my practise and not a rule.

Let me just say that I think it is pointless that we have 2 possibilities. I
know we are all about choiceses. However here we don't benefit at all with
more
options. But only adding unnecessary confusion.

And if the Standards [2] are leaning towards GPG checking. Lets say the
future
has come and make all the spells that use HASH valid bugs. But I think that
is
decision of the lead developers. They should decide (after discussion with
developers of course) in which direction our distribution should be going...
At this moment isn't going anywhere!

Best regards,
Bor


[1] https://lists.ibiblio.org/sympa/arc/sm-discuss/2011-October/020837.html
[2] http://wiki.sourcemage.org/Source_Integrity_Checking_Standards




Archive powered by MHonArc 2.6.24.

Top of Page