Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Fri, 26 Aug 2005 12:28:28 -0500

On Aug 26, Andrew [afrayedknot AT thefrayedknot.armory.com] wrote:
> > I'm not really happy with let me sign someone else's stuff and hope it
> > doesn't to anything nasty. *I* DO NOT TRUST ANYBODY so much.
>
> You signature doesnt imply that, it implies that the source someone else
> gets is the same one you got when you updated the spell. Thats it.

Absent documentation to the contrary, people are going to assume it
means the kind of thing ruskie is worried about, because that's the normal
nature of GPG signatures. We need to make sure we're clear to users about
what we're doing with these. We're going to provide a verification level
with the signature that tells users exactly what claim we're making by
signing that source. As long as we make this clear in our user-facing
documentation, it should be taken care of.

Attachment: pgpk5Co78TWjy.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page