Public SourceMage Discussion List

[Sukneet Basuta <sukneet AT gmail.com>]

On Sat, Dec 03, 2011 at 10:15:06AM +0100, Bor Kraljič wrote:
> I created wiki page [1] with *draft* for new standards. I copied the old 
> standards, underlined parts that it would be a good idea to change (or at 
> least discussed). For 2 out of 3 parts we already started the discussion.
> 
> I also made few minor layout changes. 
> 
> I purpose that we make changes in this draft. And when we reach some kind 
> of 
> consense we vote on new standard according to our voting policy. 
> 
> [1] 
> http://www.sourcemage.org/projects/grimoire/wiki/Source_Integrity_Checking_Standards

Good idea! The only problem I have with it is the situation where a developer 
agrees with one change but not another. For this reason, I think we should 
first vote on the major changes.

Thus, I move to a vote that Source_Integrity_Checking_Standards [1] be 
modified so hashsums are the standard for non-upstream signed sources (i.e. 
verification levels WORKS_FOR_ME through VERIFIED_UPSTREAM_HASH).

I also move to a vote that Source_Integrity_Checking_Standards [1] be 
modified to state that upstream signed sources (i.e. verification levels 
UPSTREAM_KEY through ID_CHECK_UPSTREAM_KEY) must be supplemented with a hash 
of the signature and that it be implemented on the next major release of 
sorcery (0.16).

[1] 
http://www.sourcemage.org/projects/grimoire/wiki/Source_Integrity_Checking_Standards

Attachment: pgpn6gaTCUvv5.pgp
Description: PGP signature