Public SourceMage Discussion List

["Andrew \"ruskie\" Levstik" <ruskie AT mages.ath.cx>]

Ladislav Hagara wrote :

> >
> >
> >> Yep I like this idea. Why not always using a hash, and adding vendor
> >> signing when it's available ?
> >
> > Please re-read the thread and you'll know why.
> 
> 
> Eric, I have the same problem. I really don't understand "Why not always
> using a hash, and adding vendor
> signing when it's available ?". These threads are only very long but no
> discussions. Some of you don't want to listen. It was decided some time
> before this discussion.  Some of you arranged it probably on irc or
> personally and we other have to just accommodate you.
> 
> [---=| Quote block shrinked by t-prot: 6 lines snipped |=---]
> >> users.
> >
> > We're not banning the better technological approach, but, after the
> > poll I conducted, we are going to continue to support hashsums for the
> > foreseeable future with `gpg --print-md`.
> 
> Yea, according to several of you it is better technological approach.
> But I know developers who don't agree with it.
> What it the result of that poll? Who agree? Who don't agree?
> It is the same as our leaders polls. I know only "and winner is ...".
> Personally I would like to know who voted who. What was the difference.
> I would like to have this process more transparent.
> 
> >> # cast xyz
> >> Checking xyz's developers gpg signing ... OK.
> >> Checking Source Mage hash ... OK
> >> ...
> >
> > Why not just one?
> 
> It was written. As you wrote "Please re-read the thread and you'll know 
> why."
> We know nothing about application developer's signing policy. Their web
> site can be cracker, their private key can be stolen.
> Lets go to download new repackage of xyz with good signature with "rm
> -rf /*". Our hash can help to prevent it.
> 
> >> What is the result of our discussion? What is the result of GPG signing
> >> poll?
> >
> > Whoops, I responded as I read, sorry. Answer is above. ;)
> 
> Yea, it is very transparent. Thank you.
> 
> > Short answer: We will continue to support hashsums as well as GPG.
> 
> How long? To next accidental irc meeting?
> 
> Some last changes are quite annoying for me. Changes in perforce
> (subject and sender, your sweet diffs). This "discussion" about gpg
> signing. Refusing of Benoit's work. Do you really think
> http://www.sourcemage.org/developers looks/is better than
> http://wiki.sourcemage.org/index.php?page=The+Source+Mage+Developers ?
> 
> On the other side, I can only thank you all for developing this great
> distro.
> 
> --
> Ladislav Hagara
> Source Mage GNU/Linux Developer
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
> 
> 

Can we put this thread to it's grave now? Please????
It served it's purpose... Start a new one to discuss recent
changes and so on...

-- 
Andrew "ruskie" Levstik
Source Mage GNU/Linux Games grimoire guru

Key id = 9A5117F8
Key fingerprint = 6731 FEF2 99A8 4672 5962  69AB 3DAF DA67 9A51 17F8