Public SourceMage Discussion List

[Mads Laursen <smgl AT dossen.dk>]

On 23/12/04 00.03, Seth Alan Woolley wrote:
[snip a lot of really good stuff about pgp in SMGL]

Two small questions:

1) Is signing less than a full grimoire (spell or section) supported,
or is such support intended/planed? Would it make sense? (Signatures
on single spells could be done manually, by the guru fixing the spell.)
(Implementation idea: Define spell (section) signature as the
signature of a tarball with a specific set of options/excludes (no
need to sign stuff like pgpkeys and sigs, or files that are otherwise
not interesting) of the spell.)

2) I read the gnupg-users list, and one of the neat features in 1.4.x
(which is already in test (good work!)) is support for prefered key
URL in keys and signatures. Will you make use of this? Maybe make it
policy to have keys and signatures pointing at the smgl keyserver/keys
on sourcemage.org? That way gpg knows to go there for (absolutely
fresh) updates. And sorcery could import keys from
grimoires/sorcery/whereever to get a baseline (that will keep working
when disconnected).

Just what I thought of while reading your post. And once again:
Wonderful to get gpg-support in sorcery. Something nice for christmas
;-) Thanks.

/dossen

PS: Just one more. Since gpg 1.4.x can be assumed on SMGL (it's in
there, it's the stable version, and it's new and shiny ;-)), consider
advising the use of signing subkeys. With support for URLs in
signatures (and sorcery supposed to import the needed keys anyway), it
should not cause problems (in this context), and it allows the keys
used to sign to be changed as needed, without the main key (which is
linked in the Web of Trust) being revoked. In fact, a signing subkey
used for automatic signing (which I assume, from reading your posting,
will be used for at least the grimoires) can be seperated from the
main key and set to expire really fast (to be replaced by a new one),
reducing the risk of a compromise.

PPS: Sorry if this is longwinded, or if I'm repeating things said (or
thought) before. I'd just like us to get this as good (and secure) as
possible (without stopping the project dead in its tracks from
security concerns).

PPPS: Merry cristmas to all. And thanks for this great distro.
You guys Rock!
-- 
Common sense is the collection of prejudices acquired by age eighteen.
                -- Albert Einstein

Attachment: pgpekAqsCH_kY.pgp
Description: PGP signature