Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Wed, Aug 31, 2005 at 07:08:07PM -0400, Sergey A. Lipnevich wrote:
> On Wed, 2005-08-31 at 15:59 -0700, Andrew wrote:
> > There is no keyserver, guru signing keys are not published to any
> > keyserver unless the guru wants to, but theres no point to it, the keys
> > are taken from the gurus.gpg keyring included in the grimoire.
> 
> Well then it's exactly the same as hash values :-), in that until the
> grimoire (or keyring) is downloaded, nothing can be checked. If as you
> suggest a method exists to alert the user that there's an updated
> signature, hashes could be part of this method.

(var) UPDATED, (file) HISTORY, (file) SECURITY, (file) ChangeLog are 
four such methods.

Seth

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454  E082 99F0 69DC FDCE E733

Attachment: pgpilTbt1O_Sz.pgp
Description: PGP signature