Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

On Aug 26, Andrew [afrayedknot AT thefrayedknot.armory.com] wrote:
> > I'm not really happy with let me sign someone else's stuff and hope it
> > doesn't to anything nasty. *I* DO NOT TRUST ANYBODY so much.
> 
> You signature doesnt imply that, it implies that the source someone else
> gets is the same one you got when you updated the spell. Thats it.

Absent documentation to the contrary, people are going to assume it
means the kind of thing ruskie is worried about, because that's the normal
nature of GPG signatures.  We need to make sure we're clear to users about
what we're doing with these.  We're going to provide a verification level
with the signature that tells users exactly what claim we're making by
signing that source.  As long as we make this clear in our user-facing
documentation, it should be taken care of.

Attachment: pgpk5Co78TWjy.pgp
Description: PGP signature