Public SourceMage Discussion List

["Andrew \"ruskie\" Levstik" <ruskie AT mages.ath.cx>]

Jeremy Blosser (emrys) wrote :

> PGP verify signed message
> gpg: Signature made pet 26 avg 2005 19:28:28 CEST using DSA key ID F009764F
> gpg: Good signature from "Jeremy Blosser <jblosser AT firinn.org>"
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg:          There is no indication that the signature belongs to the 
> owner.
> Primary key fingerprint: 867D C269 21C2 7643 E9E3  6478 285D BEC5 F009 764F
> PGP verification success
> 
> 
> On Aug 26, Andrew [afrayedknot AT thefrayedknot.armory.com] wrote:
> > > I'm not really happy with let me sign someone else's stuff and hope it
> > > doesn't to anything nasty. *I* DO NOT TRUST ANYBODY so much.
> > 
> > You signature doesnt imply that, it implies that the source someone else
> > gets is the same one you got when you updated the spell. Thats it.
> 
> Absent documentation to the contrary, people are going to assume it
> means the kind of thing ruskie is worried about, because that's the normal
> nature of GPG signatures.  We need to make sure we're clear to users about
> what we're doing with these.  We're going to provide a verification level
> with the signature that tells users exactly what claim we're making by
> signing that source.  As long as we make this clear in our user-facing
> documentation, it should be taken care of.
> 
> 
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
> 
> 

Tnx for clarification.

-- 
Andrew "ruskie" Levstik
Source Mage GNU/Linux Games grimoire guru

Key id = 9A5117F8
Key fingerprint = 6731 FEF2 99A8 4672 5962  69AB 3DAF DA67 9A51 17F8