Public SourceMage Discussion List

[Sukneet Basuta <sukneet AT gmail.com>]

On Thu, Dec 1, 2011 at 10:32 AM, Bor Kraljič <pyrobor AT ver.si> wrote:
> SOURCE_HASH vs GPG SMGL.
>
> I usually use the same method as it was previously used in spell. I try not
> change the method. However that is only my practise and not a rule.
>
> Let me just say that I think it is pointless that we have 2 possibilities. I
> know we are all about choiceses. However here we don't benefit at all with 
> more
> options. But only adding unnecessary confusion.
>
> And if the Standards [2] are leaning towards GPG checking. Lets say the 
> future
> has come and make all the spells that use HASH valid bugs. But I think that 
> is
> decision of the lead developers. They should decide (after discussion with
> developers of course) in which direction our distribution should be going...
> At this moment isn't going anywhere!
>
> Best regards,
> Bor
>
>
> [1] https://lists.ibiblio.org/sympa/arc/sm-discuss/2011-October/020837.html
> [2] http://wiki.sourcemage.org/Source_Integrity_Checking_Standards

I agree. In this case, I'd rather follow whatever the standard is,
which I thought was outlined in
http://wiki.sourcemage.org/Source_Integrity_Checking_Standards .

Who exactly is in charge of setting the standards? Is it up to one
developer? Or must the lead developers have a vote?

There is some interesting discussion going on here, signature hashes
sounds like an interesting idea, but right now I'm just trying to
figure out if I should be using GPG verification for non-upstream
signed sources or hash sums.