Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:

> On Aug 29, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
> > Quoting Eric Sandall <eric AT sandall.us>:
> > > You seem to have missed the entire conversation. That's exactly what
> > > we've been saying the entire time and we've corrected people who
> > > posted misunderstandings: GPG is being used to verify the tarball is
> > > what the guru used, nothing more, nothing less.
> >
> > No I didn't. And my answer to this is as I said before: you're trying to
> > substitute a different meaning for something that already has a meaning.
>
> It is at best disingenious to continue to act as though signatures can only
> have one meaning.  Digital signatures are today used in the real world for
> more than one thing.  Our signatures on our grimoires -- which encompass the

I disagree. Signature means essentially one thing: you personally accept
responsibility for something. Try "define:signature" in Google or look 
it up on
M-W.com and you will see the key theme behind all relevant definitions: 
identity
of the signee.

> > Please read my original item #4. Using Jeremy's analogy, signing an email
>
> Again, I wasn't making an analogy, I was making a point that signatures can
> mean more than one thing, and people are used to this.

I'm sorry, but your point is invalid in my eyes, for the reason I have stated
multiple times.

> > So, I would agree to sign the *spell* that I altered, but not the
> > *source* coming from a 3rd party web site.
>
> I ask again, would it make you feel any better to use a key that did not
> have your name on it, but instead had a name indicating it was a source
> integrity verification key only.

If you have a good plan for managing such a key so that developers cannot
willingly or unwillingly frame each other, I'd like to hear it.

Sergey.