Public SourceMage Discussion List

[Sukneet Basuta <sukneet AT gmail.com>]

Ladislav Hagara stated to me that sha512 is equivalent to gpg
verification, implying there is no reason to switch one to the other.
I suppose this does make sense if it is not vendor signed. However,
http://wiki.sourcemage.org/Source_Integrity_Checking_Standards states
that everything should be switched over to gpg verification. Ladislav
never responded to my reply below, so I decided I'd ask here.

Should I not be converting spells that already have sha512 hashes to
gpg verification?

I noticed that quite a few spells have SOURCE_GPG commented out and
instead have SOURCE_HASH. This seems to go against the wiki document I
linked to above, granted that document is pretty old. So what is the
official stance on this? Or does it ultimately not matter?



---------- Forwarded message ----------
From: Sukneet Basuta <sukneet AT sourcemage.org>
Date: Sun, Nov 20, 2011 at 3:15 PM
Subject: Re: [SM-Commit] GIT changes to master grimoire by Sukneet
Basuta (c89a58ac4be591aed17298ed63d5884aad0c997e)
To: Ladislav Hagara <ladislav.hagara AT unob.cz>
Cc: "sm-commit AT lists.ibiblio.org" <sm-commit AT lists.ibiblio.org>


On Sun, Nov 20, 2011 at 10:06 AM, Ladislav Hagara
<ladislav.hagara AT unob.cz> wrote:
>> Why sha512 to gpg verification? They are equivalent.
>> And according to http://wiki.sourcemage.org/HISTORY there is no reason
>> to mention it in HISTORY.

I was under the impression that GPG verification is better than hash
verification, but thinking about it, unless its vendor signed, they
are probably equal.
http://wiki.sourcemage.org/Source_Integrity_Checking_Standards states
that all spells should be moved to GPG verification. It also states
" The following are not valid bugs yet, but may be in the future:
   Spells which use SOURCE_HASH instead of SOURCE_GPG."
I figured we may as well start moving them over now if they do
eventually become bugs. Although, it looks like I've been ignoring
putting in the verification level.

Should I not bother switching things over to GPG verification?

I've been mentioning it in HISTORY because I think its a good idea to
mention any changes should things like this occur.