Public SourceMage Discussion List

[Ladislav Hagara <ladislav.hagara AT unob.cz>]

> So, I support use of GPG signatures, but for the correct
> purpose. Verifying integrity of the source tarballs is not a sufficient
> purpose.

I agree with Sergey.
Moreover, we shouldn't blindly trust vendors signing.
Do we really know the developer of application XYZ is able to protect 
his key?
Now if cracker gain access to application's web pages and to developer's 
key (yes it is possible) he can create new tarball with "rm -rf /*" and 
sorcery run it because sources are signed by developer. Cracker is not 
able to change our HASH (neither md5) in grimoire. Of course never say 
never. :-)

And of course some changes should be approved by team not only
"people who hang out there (not necessarily all stakeholders or 
interested parties), it was agreed ...".

--
Got yourself a ledger.sourcemage.org account?
http://ledger.sourcemage.org/

Ladislav Hagara
Source Mage GNU/Linux Developer
http://www.sourcemage.org/