Public SourceMage Discussion List

[Sukneet Basuta <sukneet AT gmail.com>]

On Thu, Dec 1, 2011 at 12:10 AM, flux <flux AT sourcemage.org> wrote:
> I should add that my previous post was concerned with upstream signed
> sources. If a source is signed by us, then the signature vs. the hashsum
> are still not technically equivalent, but the signature will bear far
> less weight, making the two practically equivalent (emphasis on
> practically, as in "in practice").
>

Sorry, my question was regarding guru signed verification if it wasn't
clear (specifically the WORKS_FOR_ME verification level). I don't
think there is any argument against the fact that upstream signed
sources are better than hashes. I believe Ladislav was stating that
they are practically equivalent.