Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Sukneet Basuta <sukneet AT gmail.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Sun, 4 Dec 2011 01:09:24 -0500

On Sat, Dec 03, 2011 at 10:15:06AM +0100, Bor Kraljič wrote:
> I created wiki page [1] with *draft* for new standards. I copied the old
> standards, underlined parts that it would be a good idea to change (or at
> least discussed). For 2 out of 3 parts we already started the discussion.
>
> I also made few minor layout changes.
>
> I purpose that we make changes in this draft. And when we reach some kind
> of
> consense we vote on new standard according to our voting policy.
>
> [1]
> http://www.sourcemage.org/projects/grimoire/wiki/Source_Integrity_Checking_Standards

Good idea! The only problem I have with it is the situation where a developer
agrees with one change but not another. For this reason, I think we should
first vote on the major changes.

Thus, I move to a vote that Source_Integrity_Checking_Standards [1] be
modified so hashsums are the standard for non-upstream signed sources (i.e.
verification levels WORKS_FOR_ME through VERIFIED_UPSTREAM_HASH).

I also move to a vote that Source_Integrity_Checking_Standards [1] be
modified to state that upstream signed sources (i.e. verification levels
UPSTREAM_KEY through ID_CHECK_UPSTREAM_KEY) must be supplemented with a hash
of the signature and that it be implemented on the next major release of
sorcery (0.16).

[1]
http://www.sourcemage.org/projects/grimoire/wiki/Source_Integrity_Checking_Standards

Attachment: pgpn6gaTCUvv5.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page