sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

From: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
To: sm-discuss AT lists.ibiblio.org
Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
Date: Mon, 29 Aug 2005 10:35:29 -0500

On Aug 29, Ladislav Hagara [ladislav.hagara AT unob.cz] wrote:
> >
> > So, I support use of GPG signatures, but for the correct
> > purpose. Verifying integrity of the source tarballs is not a sufficient
> > purpose.
> >
>
> I agree with Sergey.
> Moreover, we shouldn't blindly trust vendors signing.
> Do we really know the developer of application XYZ is able to protect
> his key?

We can't provide perfect security, but this is no reason to not try to
provide as much as we can. Like Sergey I like the idea of letting our
users make the decision.

Attachment: pgpUI1Usg8BXr.pgp
Description: PGP signature

Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support , (continued)
- Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
  - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Jeremy Blosser (emrys), 08/29/2005
    - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
      - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Jeremy Blosser (emrys), 08/29/2005
        
        Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
  - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Ladislav Hagara, 08/29/2005
    - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
    - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Jeremy Blosser (emrys), 08/29/2005
  - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Andrew "ruskie" Levstik, 08/29/2005
  - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Eric Sandall, 08/29/2005
    - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
      - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Jeremy Blosser (emrys), 08/29/2005
        
        Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
        
        Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Jeremy Blosser (emrys), 08/29/2005
        
        Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
        Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, David Kowis, 08/29/2005
        Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Sergey A. Lipnevich, 08/29/2005
        Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, David Kowis, 08/29/2005