Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Compromise on signatures

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Compromise on signatures
  • Date: Tue, 30 Aug 2005 15:17:19 -0400

Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:

I'm having trouble with this. Signing something that includes a statement
"SOURCE_HASH=sha1:1663d32bcd24fc3ec7d7168c47a44e4dcdb82266' is not
technically any different from just signing the referenced source tarball,

Technically no, but the *meaning* and *intent* are different.

and if people understand the issues involved, it's not different
sociologically either. It's just obfusctation that seems most likely to
promote developers not understanding what they even are and aren't signing.

I in good faith believe that you are committing a big mistake by signing a
tarball that you know nothing about. The disclaimer may help you feel better,
but it doesn't help me at all. I am trying to prevent restrictions to be
imposed so that people who know better don't make this mistake. I am *not*
trying to prevent *you* from doing that. Go right ahead.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page