Public SourceMage Discussion List

[Arwed von Merkatz <v.merkatz AT gmx.net>]

On Wed, Aug 31, 2005 at 04:00:15PM -0700, Seth Alan Woolley wrote:
> Personally, signed by guru anywhere is acceptable to me.  HOWEVER, I've 
> proposed ways to resolve this conflict: 1 is with DETAILS signing, and 2 
> is with anonymous key names with a clickthrough wrapper over the 
> security policy to find the identity.  2 is cleanest (and not everybody 
> has to participate), but 1 is "I'll put up with it".  Sergey seems to 
> have rejected number 2.
> 
> I fear though we'll lose Sergey if the clean method is proposed, but I 
> just don't see any reason why he can't use the clean method other than 
> an irrational fear or out of spite.
> 
> Lastly, we all need to let our egos take a step back and let Sergey and 
> Arwed think about for a bit before pushing somebody to a decision.  I 
> hope all that's needed to be said has been said at this point and a 
> little reflection will resolve the situation.
> 
> It seems Arwed gets to decide which path we take -- the Clean or the 
> DETAILS (or entire spell) signature method (we really can't do a 
> PGP-based scm at this point) if Thomas isn't going to pipe in.  I'd like 
> unanimity from Leads in every policy change such as this.

I don't really decide it as all I do is add my opinion to that of the
other team leads.
DETAILS signing might work, but it's definitely more work than I'd like
it to be; you have to download the source, hash it, put the hash in
DETAILS, then sign DETAILS, whereas with plain source signatures you
only have to download and sign.
I'd really like to go for plain source signatures, combined with option
2) above for those who don't want to sign with their names.

-- 
Arwed v. Merkatz                              Source Mage GNU/Linux developer
                                                    http://www.sourcemage.org