Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Mon, 29 Aug 2005 11:58:33 -0500

On Aug 29, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
> Quoting Eric Sandall <eric AT sandall.us>:
> > You seem to have missed the entire conversation. That's exactly what
> > we've been saying the entire time and we've corrected people who
> > posted misunderstandings: GPG is being used to verify the tarball is
> > what the guru used, nothing more, nothing less.
>
> No I didn't. And my answer to this is as I said before: you're trying to
> substitute a different meaning for something that already has a meaning.

It is at best disingenious to continue to act as though signatures can only
have one meaning. Digital signatures are today used in the real world for
more than one thing. Our signatures on our grimoires -- which encompass the
spells, some included patches we didn't write, and other things -- are yet
another example of this. People can cope with this.

> Please read my original item #4. Using Jeremy's analogy, signing an email

Again, I wasn't making an analogy, I was making a point that signatures can
mean more than one thing, and people are used to this.

> So, I would agree to sign the *spell* that I altered, but not the
> *source* coming from a 3rd party web site.

I ask again, would it make you feel any better to use a key that did not
have your name on it, but instead had a name indicating it was a source
integrity verification key only.

Attachment: pgp4Q6IdRIHDQ.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page