Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

On Aug 29, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
> Quoting Eric Sandall <eric AT sandall.us>:
> > You seem to have missed the entire conversation. That's exactly what
> > we've been saying the entire time and we've corrected people who
> > posted misunderstandings: GPG is being used to verify the tarball is
> > what the guru used, nothing more, nothing less.
> 
> No I didn't. And my answer to this is as I said before: you're trying to
> substitute a different meaning for something that already has a meaning.

It is at best disingenious to continue to act as though signatures can only
have one meaning.  Digital signatures are today used in the real world for
more than one thing.  Our signatures on our grimoires -- which encompass the
spells, some included patches we didn't write, and other things -- are yet
another example of this.  People can cope with this.

> Please read my original item #4. Using Jeremy's analogy, signing an email

Again, I wasn't making an analogy, I was making a point that signatures can
mean more than one thing, and people are used to this.

> So, I would agree to sign the *spell* that I altered, but not the
> *source* coming from a 3rd party web site.

I ask again, would it make you feel any better to use a key that did not
have your name on it, but instead had a name indicating it was a source
integrity verification key only.

Attachment: pgp4Q6IdRIHDQ.pgp
Description: PGP signature