Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Mon, 29 Aug 2005 14:26:57 -0400

Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:

On Aug 29, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
Quoting Eric Sandall <eric AT sandall.us>:
> You seem to have missed the entire conversation. That's exactly what
> we've been saying the entire time and we've corrected people who
> posted misunderstandings: GPG is being used to verify the tarball is
> what the guru used, nothing more, nothing less.

No I didn't. And my answer to this is as I said before: you're trying to
substitute a different meaning for something that already has a meaning.

It is at best disingenious to continue to act as though signatures can only
have one meaning. Digital signatures are today used in the real world for
more than one thing. Our signatures on our grimoires -- which encompass the

I disagree. Signature means essentially one thing: you personally accept
responsibility for something. Try "define:signature" in Google or look it up on
M-W.com and you will see the key theme behind all relevant definitions: identity
of the signee.

Please read my original item #4. Using Jeremy's analogy, signing an email

Again, I wasn't making an analogy, I was making a point that signatures can
mean more than one thing, and people are used to this.

I'm sorry, but your point is invalid in my eyes, for the reason I have stated
multiple times.

So, I would agree to sign the *spell* that I altered, but not the
*source* coming from a 3rd party web site.

I ask again, would it make you feel any better to use a key that did not
have your name on it, but instead had a name indicating it was a source
integrity verification key only.

If you have a good plan for managing such a key so that developers cannot
willingly or unwillingly frame each other, I'd like to hear it.

Sergey.






Archive powered by MHonArc 2.6.24.

Top of Page