Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:

> I'm having trouble with this.  Signing something that includes a statement
> "SOURCE_HASH=sha1:1663d32bcd24fc3ec7d7168c47a44e4dcdb82266' is not
> technically any different from just signing the referenced source tarball,

Technically no, but the *meaning* and *intent* are different.

> and if people understand the issues involved, it's not different
> sociologically either.  It's just obfusctation that seems most likely to
> promote developers not understanding what they even are and aren't signing.

I in good faith believe that you are committing a big mistake by signing a
tarball that you know nothing about. The disclaimer may help you feel better,
but it doesn't help me at all. I am trying to prevent restrictions to be
imposed so that people who know better don't make this mistake. I am *not*
trying to prevent *you* from doing that. Go right ahead.

Sergey.