Public SourceMage Discussion List

[Ladislav Hagara <hgr AT vabo.cz>]

> I'm a new user of sourcemage since this night

Welcome aboard. :-))

> I've an idea to ameliorate the security of grimory :
> The maintener of package includes an gpg signature with same spell.
> If the grimory server is pirated, the cracker won't modify grimory
> without detected by the sourcemage users.
> The GPG public key of mainteners would be on several independent servers.

We discussed this several times already, see for example:
https://lists.ibiblio.org/sympa/arc/sm-security/2003-May/000051.html

http://wiki.sourcemage.org/index.php?page=spell-gpg-howto

For info about gpg public key of maintainers visit:
http://wiki.sourcemage.org/index.php?page=smgl-keysigning

It is quite difficult to sign individual spells.
We might sign all grimoires published on http://codex.sourcemage.org.
For example stable.tar.bz2 and stable.tar.bz2.sign.
Maybe after 1.0.

- lace -