Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Summary of GPG Discussions / For Real Proposal

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Summary of GPG Discussions / For Real Proposal
  • Date: Thu, 25 Aug 2005 16:42:51 -0500

On Aug 19, Jeremy Blosser (emrys) [jblosser-smgl AT firinn.org] wrote:
> On Aug 19, Eric Sandall [eric AT sandall.us] wrote:
> > On Fri, 19 Aug 2005, Jeremy Blosser (emrys) wrote:
> > > On Aug 17, Jeremy Blosser (emrys) [jblosser-smgl AT firinn.org] wrote:
> > >> We had a pretty productive discussion about all these GPG threads on
> > >> IRC
> > >> today; I'm going to try and summarize what the consensus of that
> > >> discussion and these ML threads seems to be. Please jump in if I get
> > >> something wrong.
> > >
> > > I've put this up with the discussed changes at:
> > >
> > > http://www.sourcemage.org/security-source_integrity_checking_standards
> > >
> > > It's not published yet so we can discuss it further if we need to; once
> > > we're done we can publish it and consider it policy.
> >
> > You need to Publish these if you want more than about four people to
> > be able to read them. ;/ Just don't Promote it to the front-page and
> > you should be good. You can also allow comments for feedback if you'd
> > like, we can delete them after they've been put in.
>
> Ok, it's published and comments are enabled. I mostly wanted it clear it's
> not done yet but this handy 'DRAFT' header someone suggested I add seems to
> cover that. ;-)

I made a couple changes to the listed verification methods:

- developer home pages are acceptable sources
- other projects with verification methods at least as strict as ours are
acceptable sources (eg debian)
- any secondary sources (mailing list archives/etc.) need to come from a
different server than the primary distribution site if that site is
already one of the sources for the key

Any final comments before I remove the "DRAFT" header?

Attachment: pgp65X601O01s.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page