Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: Seth Alan Woolley <seth AT positivism.org>
  • Cc: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Tue, 30 Aug 2005 16:43:40 -0400

Quoting Seth Alan Woolley <seth AT positivism.org>:

Furthermore, the recipient may wish to be certain of the originator's
identity.

Who sent it!

So let me break it you if that's still not clear: I don't want to be the
originator of any tarball I didn't read the code of. And no, originator is not
just who sent it. The build engineer is the originator, and if they're not
willing to sign it, I am not in a position to second-guess them.

It's a good thing you're reading standards, but let me ask about your
entitlements. Disclosure: I don't have any security-related certifications. Do
you? If we're just two guys argueing about merits of the standard, then I'm
afraid we read remain at a disagreement.

I am also not confusing things as you suggested. I am trying to explain them to
those who are willing to listen. I am also trying to have my choice back.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page