Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting Seth Alan Woolley <seth AT positivism.org>:

> > >What circumstance would make acceptable a third-party source signing by
> > >a member of our team?
> >
> > No, see my answers above and the "threat profile" message.
>
> No circumstances?

I'm afraid none of the circumstances would involve directly associating my
identity with any 3rd-party package, regardless of the disclaimer, so the
answer is still negative, sorry.
I tried to show that even from technical POV using GPG signatures (see all the
assumptions in my other message) is not a good idea. I'd appreciate if you let
me know, based on my threat analysis, why I should subject myself to the
scrutiny of keys if in our case hashes provide the same threat protection with
added convenience of not being personal?

Thanks,
Sergey.