Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Andrew \"ruskie\" Levstik" <ruskie AT mages.ath.cx>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Fri, 26 Aug 2005 18:43:15 +0200

Jeremy Blosser (emrys) wrote :

> PGP verify signed message
> gpg: Signature made pet 26 avg 2005 18:33:33 CEST using DSA key ID F009764F
> gpg: Good signature from "Jeremy Blosser <jblosser AT firinn.org>"
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg: There is no indication that the signature belongs to the
> owner.
> Primary key fingerprint: 867D C269 21C2 7643 E9E3 6478 285D BEC5 F009 764F
> PGP verification success
>
>
> On Aug 26, Seth Alan Woolley [seth AT positivism.org] wrote:
> > DRAFT, although this is one case where we're actually moving on it
> > quickly, so it's more of a last call for objections.
>
> I don't have any objections, though I'd really like to hear from any gurus
> who lost interest in this topic a while ago. We need to do this stuff but
> it is tedious, anything we can do to make it less of an issue for those
> that don't care would be good (though everyone needs to care at least
> enough to do things like keep their private key secure, etc.). We
> definitely don't want the result to be that people update spell versions
> less and less, so if you have concerns of that, or don't get how to
> generate your guru keys/signatures correctly, please comment. We are
> trying to make it so moving to GPG makes updates *easier*, after the
> initial setup.
>
>
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>
>

I don't see how this makes updates easier... But ok leave that.
I'm not really happy with let me sign someone else's stuff and hope it doesn't
to anything nasty. *I* DO NOT TRUST ANYBODY so much.

But I'm guessing implementing a single point of security would be easier to
maintain than to have some hash and some gpg signed. Though I'd go like this:
Use GPG for really important stuff/or where available gpg sig from upstream.
And use HASH for everything else.

--
Andrew "ruskie" Levstik
Source Mage GNU/Linux Games grimoire guru

Key id = 9A5117F8
Key fingerprint = 6731 FEF2 99A8 4672 5962 69AB 3DAF DA67 9A51 17F8




Archive powered by MHonArc 2.6.24.

Top of Page