sm-discuss AT lists.ibiblio.org
Subject: Public SourceMage Discussion List
List archive
[SM-Discuss] Clarifications on GPG signing of source tarballs
- From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
- To: sm-discuss AT lists.ibiblio.org
- Subject: [SM-Discuss] Clarifications on GPG signing of source tarballs
- Date: Wed, 17 Aug 2005 09:50:05 -0400
Hi All,
This is a request for comments after the discussion started here:
https://lists.ibiblio.org/sympa/arc/sm-discuss/2005-August/011831.html.
Some of the spell I created started being signed by other SMGL
maintainers. I'd like clarifications on such signatures, as opposed to
ones coming from upstream. What do I, or any maintainer without a
signature, do if I want to upgrade them to new version? I suppose I can
either get the key and get it signed, or not.
In case I get the key, I'd gladly sign a *spell*, but I'm reluctant to
sign a *source package* coming from its author(s). I don't trust any of
the upstream package maintainers who don't sign tarballs themselves.
It's not clear how I can make sure their packages are safe, but it's
obvious that amount of work to make this happen it pretty high. I look
at it this way: by signing a package from upstream, I implicitly give my
trust to somebody I don't know. Would you consider signing a GPG key for
somebody you don't know? It's the same question.
The other alternative is to not get a key for myself. Am I allowed to
convert a spell with SMGL maintainer signature back to MD5- or
SHA-hashed source tarball when I upgrade it? If no, I come back to trust
issue above. If yes, what's the point of using those signatures?
Ultimately, it comes down to the whether we require all maintainers to
have GPG keys before they can work on grimoires, so this question must
be addressed at a very high level of SMGL policies.
Finally, if I have to get a GPG key, how do I get it signed? I know
there's nobody close to NYC contributing to SMGL, at least I think so.
Rutgers University nearby has an LUG, but I've never tried contacting
them. What do people do in this case?
Thanks,
Sergey.
-
[SM-Discuss] Clarifications on GPG signing of source tarballs,
Sergey A. Lipnevich, 08/17/2005
- Re: [SM-Discuss] Clarifications on GPG signing of source tarballs, Jeremy Blosser (emrys), 08/17/2005
-
Re: [SM-Discuss] Clarifications on GPG signing of source tarballs,
Eric Sandall, 08/17/2005
-
Re: [SM-Discuss] Clarifications on GPG signing of source tarballs,
Seth Alan Woolley, 08/17/2005
- Re: [SM-Discuss] Clarifications on GPG signing of source tarballs, Jeremy Kolb, 08/17/2005
-
Re: [SM-Discuss] Clarifications on GPG signing of source tarballs,
Seth Alan Woolley, 08/17/2005
- Re: [SM-Discuss] Clarifications on GPG signing of source tarballs, Seth Alan Woolley, 08/17/2005
Archive powered by MHonArc 2.6.24.