Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 31 Aug 2005, Sergey A. Lipnevich wrote:
<snip>
> I appreciate what you are trying to do Seth, it's very constructive.
> It's signing tarballs against my will that will never sit well in my
> mind. For example, I used to be a Subversion committer, and I read a lot
> of its code. I trust people on the team, and I know all code is being
> reviewed, because the make it so. I'd feel very comfortable signing
> their tarball. They however already provide such signatures, so my
> support is not needed. For packages that don't have signatures, their
> authors' level of development culture is probably lower (or they don't
> want to deal with signatures), so there's no reason to make these
> tarballs appear to be coming from a trusted source.
<snip>
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
I think right there is the problem. We're not saying we're a trusted
source. We're only saying that the tarball you, the user, are
receiving is the same as the developer who updated the spell received
and used to test the update.

- -sandalle

- --
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us                  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDFpkeHXt9dKjv3WERApRbAJ4s/QyMntnCqccJQO7NfgqfYVZDXgCcCgo/
CGKiBWCDmGqHdhHovGTZfmY=
=h8ua
-----END PGP SIGNATURE-----