Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 5 Sep 2005, Ladislav Hagara wrote:
> > Yep I like this idea. Why not always using a hash, and adding vendor
> > signing when it's available ?

Please re-read the thread and you'll know why.

> My kindred spirit. :-)
>
> Personally I would ban smgl's developers gpg signs. There are/will be
> only problems with them.
> I would like us to use only hashes (probably created by gpg --print-md).
> Of course "adding vendor signing when it's available" is great for our
> users.

We're not banning the better technological approach, but, after the
poll I conducted, we are going to continue to support hashsums for the
foreseeable future with `gpg --print-md`.

> I would like to see:
> # cast xyz
> Checking xyz's developers gpg signing .... OK.
> Checking Source Mage hash ... OK
> ...

Why not just one?

> BTW,
> What is the result of our discussion? What is the result of GPG signing
> poll?

Whoops, I responded as I read, sorry. Answer is above. ;)

Short answer: We will continue to support hashsums as well as GPG.

- -sandalle

- --
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us                  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDIH5UHXt9dKjv3WERAtZwAJ9ofcRsnhZo/5hbQtpyW3i4tiOdEwCgr057
v7jkupM64NME9u8UprDezYQ=
=fhb5
-----END PGP SIGNATURE-----