Public SourceMage Discussion List

[Mads Laursen <smgl AT dossen.dk>]

On 29/08/05 16.31, Jeremy Blosser (emrys) wrote:
> On Aug 29, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
> > Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:
> > 
> > > I'm sure most people are really tired of this thread before it even
> > > started, so I really want to bring my responses to a close.  If you have
> > > things you think there is value in continuing to discuss, I'm willing to
> > > keep talking, but otherwise we should probably agree to end this soon 
> > > and
> > > see if other project members have input.
> > 
> > Just tell me signatures are not mandatory and it's over.
> 
> That really is not my decision.

Hope nobody minds too much, that I join this thread.

Having read this discussion with some interest and skimmed the
suggested standard, I'd like to just make some observations:

- "Developers should not use their personal key for signing tarballs":
  So it is not a matter of the developer signing the source with his
  personal, trusted key, but with a seperate key, marked as such. My
  view is that such a key could be view as the equivalent as a stamp
  with "RECIEVED" or "APPROVED" that is used in a defined process.

- I seem to recall that gpg allows notations, that can provide a link
  (cryptographically secure) between a signature and a document, that
  describes the meaning and context of this signature. That document
  could be the standard.

- Perhaps the specifics of the key could be specified in the standard?
  It could for instance have a standard primary userid describing it's
  purpose (note, that I'm not talking shared keys here, just multible
  keys having the same describing userid). If easy identification of
  the developer is needed, this could be handled either by a second
  userid or via the comment and/or email fields of the primary userid.

- In keeping with the stamp idea, the keys could be signed by a master
  key, according to a specific set of standards (to be defined), and
  perhaps that key could also be given the ability to revoke the
  "stamps"? That can be done using gpg, and would support the process,
  and the defined intention of the signatures.

Anyway, just some things I came up with while reading. I truly hope I
do not offend anyone be adding my view.

And thanks to all who contribute to the great piece of software, that
handles all of my computing needs.

/dossen

Attachment: pgppuRicwn2Lm.pgp
Description: PGP signature