Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 1 Sep 2005, Sergey A. Lipnevich wrote:
> This is interesting:
> http://ask.slashdot.org/article.pl?sid=05/08/31/2045201
> It pretty much repeats our discussion in this thread, with arguments
> from both sides.

Points #2, #3, and #4 just reinforce what I (and others) are saying
about how GPG keys can be used. Point #1, IMO, for SMGL is that the
developers would do some checking (which is in our policy) that the
vendor key we're about to use is legit.

> I especially like this fragment:
> http://ask.slashdot.org/article.pl?sid=05/08/31/2045201#13450029

Why? All he's saying is that since Fedora is setup to require GPG
keys, but no packages are signed (or he had the wrong key), he just
turned off GPG checking. We wouldn't have that problem as there is no
user-interaction for adding/removing keys.

> and this one
> http://ask.slashdot.org/article.pl?sid=05/08/31/2045201#13450266

This one just points out the representation to users giving them a
mistaken idea about what the GPG key is for, not about users being
mistaken about what GPG can be used for.

Even if you want to ignore the presentation part, the poster here goes
on to say that it'd work in a tightly-controllerd environment. That
would be SMGL: Only select individuals (authors or our developers)
setup the keys, not any Joe Blow, and we tend to go through a
verification process for the keys as well (for vendor-sigs).

> There are of course pieces in support of signatures, but I'm going to
> leave searching for them for those interested :-).

Funny that the ones you pointed out hurt your case more than help it.

- -sandalle

- --
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us                  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDF3IqHXt9dKjv3WERAi4eAKDLIsVt7gDEKkGP0hc+VyxZpOgaRgCdHFeA
W+C/J877Ls1Rb4fei8vsKvo=
=7Xn3
-----END PGP SIGNATURE-----