Skip to Content.
Sympa Menu

sm-discuss - [SM-Discuss] Clarifications on GPG signing of source tarballs

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: [SM-Discuss] Clarifications on GPG signing of source tarballs
  • Date: Wed, 17 Aug 2005 09:50:05 -0400

Hi All,

This is a request for comments after the discussion started here:
https://lists.ibiblio.org/sympa/arc/sm-discuss/2005-August/011831.html.

Some of the spell I created started being signed by other SMGL
maintainers. I'd like clarifications on such signatures, as opposed to
ones coming from upstream. What do I, or any maintainer without a
signature, do if I want to upgrade them to new version? I suppose I can
either get the key and get it signed, or not.

In case I get the key, I'd gladly sign a *spell*, but I'm reluctant to
sign a *source package* coming from its author(s). I don't trust any of
the upstream package maintainers who don't sign tarballs themselves.
It's not clear how I can make sure their packages are safe, but it's
obvious that amount of work to make this happen it pretty high. I look
at it this way: by signing a package from upstream, I implicitly give my
trust to somebody I don't know. Would you consider signing a GPG key for
somebody you don't know? It's the same question.

The other alternative is to not get a key for myself. Am I allowed to
convert a spell with SMGL maintainer signature back to MD5- or
SHA-hashed source tarball when I upgrade it? If no, I come back to trust
issue above. If yes, what's the point of using those signatures?

Ultimately, it comes down to the whether we require all maintainers to
have GPG keys before they can work on grimoires, so this question must
be addressed at a very high level of SMGL policies.

Finally, if I have to get a GPG key, how do I get it signed? I know
there's nobody close to NYC contributing to SMGL, at least I think so.
Rutgers University nearby has an LUG, but I've never tried contacting
them. What do people do in this case?

Thanks,
Sergey.




Archive powered by MHonArc 2.6.24.

Top of Page