Public SourceMage Discussion List

[Ladislav Hagara <ladislav.hagara AT unob.cz>]

> > Yep I like this idea. Why not always using a hash, and adding vendor
> > signing when it's available ?
>
> Please re-read the thread and you'll know why.


Eric, I have the same problem. I really don't understand "Why not always 
using a hash, and adding vendor
signing when it's available ?". These threads are only very long but no 
discussions. Some of you don't want to listen. It was decided some time 
before this discussion.  Some of you arranged it probably on irc or 
personally and we other have to just accommodate you.

> > My kindred spirit. :-)
> >
> > Personally I would ban smgl's developers gpg signs. There are/will be
> > only problems with them.
> > I would like us to use only hashes (probably created by gpg --print-md).
> > Of course "adding vendor signing when it's available" is great for our
> > users.
>
> We're not banning the better technological approach, but, after the
> poll I conducted, we are going to continue to support hashsums for the
> foreseeable future with `gpg --print-md`. 

Yea, according to several of you it is better technological approach. 
But I know developers who don't agree with it.
What it the result of that poll? Who agree? Who don't agree?
It is the same as our leaders polls. I know only "and winner is ...".
Personally I would like to know who voted who. What was the difference. 
I would like to have this process more transparent.

> > # cast xyz
> > Checking xyz's developers gpg signing .... OK.
> > Checking Source Mage hash ... OK
> > ...
>
> Why not just one? 

It was written. As you wrote "Please re-read the thread and you'll know 
why."
We know nothing about application developer's signing policy. Their web 
site can be cracker, their private key can be stolen.
Lets go to download new repackage of xyz with good signature with "rm 
-rf /*". Our hash can help to prevent it.

> > What is the result of our discussion? What is the result of GPG signing
> > poll?
>
> Whoops, I responded as I read, sorry. Answer is above. ;)

Yea, it is very transparent. Thank you.

> Short answer: We will continue to support hashsums as well as GPG.

How long? To next accidental irc meeting?

Some last changes are quite annoying for me. Changes in perforce 
(subject and sender, your sweet diffs). This "discussion" about gpg 
signing. Refusing of Benoit's work. Do you really think 
http://www.sourcemage.org/developers looks/is better than 
http://wiki.sourcemage.org/index.php?page=The+Source+Mage+Developers ?

On the other side, I can only thank you all for developing this great 
distro.

--
Ladislav Hagara
Source Mage GNU/Linux Developer