Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Wed, 31 Aug 2005 12:38:19 -0400

Quoting Seth Alan Woolley <seth AT positivism.org>:

>What circumstance would make acceptable a third-party source signing by
>a member of our team?

No, see my answers above and the "threat profile" message.

No circumstances?

I'm afraid none of the circumstances would involve directly associating my
identity with any 3rd-party package, regardless of the disclaimer, so the
answer is still negative, sorry.
I tried to show that even from technical POV using GPG signatures (see all the
assumptions in my other message) is not a good idea. I'd appreciate if you let
me know, based on my threat analysis, why I should subject myself to the
scrutiny of keys if in our case hashes provide the same threat protection with
added convenience of not being personal?

Thanks,
Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page