Public SourceMage Discussion List

[David Kowis <dkowis AT shlrm.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Seth Alan Woolley wrote:
> On Thu, Apr 28, 2005 at 04:23:59PM -0500, David Kowis wrote:
> Anything GPG-signed for use in a stable system requires a certain level 
> of caution.  I'll make it not automatic, passphrased, and signed only 
> once when I approve the release.
One thing can be signed by multiple people right? Well, if each member
of a team has their individual GPG key then they could sign it as they
submit it to you and if it passes your check then you could sign it as well.

Or all members would submit their cache tarballs to each other, in a
sort of distributed fashion, and they'd each check the others, sign them
and pass them on. When a tarball has acquired all signatures, then it
gets submitted to you for a final test.

Or, perhaps a process of some sort could be devised to pass them along
through a series of different checks and if all parts pass then it'll
have some number of signatures, assuring that it's 100% good.
Then perhaps the automation could be an option.

Just trying to make it easier to create these things, because having
someone physically check them all could take a while. Unless you weren't
planning on physically checking them, in which case you've probably got
something figured out already :)
> 
> Perhaps we can add a tool to import caches from one system to another by 
> downloading with liburl and gpg-checking them with libunpack.  It could 
> be called "wand" -- a tool to assist magic.  I could sure use such a 
> procedure for all my boxes in odd places.  Tied with "cabal", updates 
> would be easy to distribute.
I like this idea. Especially if one has lots of computers of similar
architecture.

Don't know how hard any of this would be to implement, but I'm just
throwing out ideas to keep our tarballs safe :)

- --
One login to rule them all, one login to find them. One login to bring
them all, and in the web bind them.
http://shlrm.org
http://www.zoominfo.com/DavidKowis
http://www.flickr.com/photos/davidkowis
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCcWLVtgErhgxHMHsRAiI0AJ9W0nNCshKHYqGglZwXHRe2E5RMjgCgiOH4
IU8DMNWC7OKWBBQanU+ZKeo=
=zUrj
-----END PGP SIGNATURE-----