Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Mon, 29 Aug 2005 10:35:29 -0500

On Aug 29, Ladislav Hagara [ladislav.hagara AT unob.cz] wrote:
> >
> > So, I support use of GPG signatures, but for the correct
> > purpose. Verifying integrity of the source tarballs is not a sufficient
> > purpose.
> >
>
> I agree with Sergey.
> Moreover, we shouldn't blindly trust vendors signing.
> Do we really know the developer of application XYZ is able to protect
> his key?

We can't provide perfect security, but this is no reason to not try to
provide as much as we can. Like Sergey I like the idea of letting our
users make the decision.

Attachment: pgpUI1Usg8BXr.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page