Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Andrew \"ruskie\" Levstik" <ruskie AT mages.ath.cx>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Fri, 26 Aug 2005 20:19:43 +0200

Jeremy Blosser (emrys) wrote :

> PGP verify signed message
> gpg: Signature made pet 26 avg 2005 19:28:28 CEST using DSA key ID F009764F
> gpg: Good signature from "Jeremy Blosser <jblosser AT firinn.org>"
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg: There is no indication that the signature belongs to the
> owner.
> Primary key fingerprint: 867D C269 21C2 7643 E9E3 6478 285D BEC5 F009 764F
> PGP verification success
>
>
> On Aug 26, Andrew [afrayedknot AT thefrayedknot.armory.com] wrote:
> > > I'm not really happy with let me sign someone else's stuff and hope it
> > > doesn't to anything nasty. *I* DO NOT TRUST ANYBODY so much.
> >
> > You signature doesnt imply that, it implies that the source someone else
> > gets is the same one you got when you updated the spell. Thats it.
>
> Absent documentation to the contrary, people are going to assume it
> means the kind of thing ruskie is worried about, because that's the normal
> nature of GPG signatures. We need to make sure we're clear to users about
> what we're doing with these. We're going to provide a verification level
> with the signature that tells users exactly what claim we're making by
> signing that source. As long as we make this clear in our user-facing
> documentation, it should be taken care of.
>
>
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>
>

Tnx for clarification.

--
Andrew "ruskie" Levstik
Source Mage GNU/Linux Games grimoire guru

Key id = 9A5117F8
Key fingerprint = 6731 FEF2 99A8 4672 5962 69AB 3DAF DA67 9A51 17F8




Archive powered by MHonArc 2.6.24.

Top of Page