Public SourceMage Discussion List

[flux <flux AT sourcemage.org>]

Sukneet Basuta (sukneet AT gmail.com) wrote [11.12.04 15:27]:
> I also move to a vote that Source_Integrity_Checking_Standards [1] be 
> modified to state that upstream signed sources (i.e. verification levels 
> UPSTREAM_KEY through ID_CHECK_UPSTREAM_KEY) must be supplemented with a 
> hash of the signature and that it be implemented on the next major release 
> of sorcery (0.16).
> 
> [1] 
> http://www.sourcemage.org/projects/grimoire/wiki/Source_Integrity_Checking_Standards

There is a problem with this. You can't make the grimoire rely on
features that are not yet in stable sorcery, as that would invalidate
the grimoire for everyone using stable sorcery. Thus, you would have to
require this to go into sorcery *first*, and only after it percolated to
stable sorcery (it goes into devel first, then test, and finally stable)
could you argue to have it required for grimoire.

I think it would be better to first have a discussion/vote on whether
this is actually the best way to implement what we want to have.
Probably it's not worth it to have a discussion, since this thread has
already been going for a while and only a few of us are chiming in, so
you'd probably only get the same voices regarding implementation. Still,
calling a vote on whether we want it implemented first (vs. any other
options we can think of) would be better before calling a vote on
whether we enforce it, IMHO.

-- 
Justin "flux_control" Boffemmyer
Cauldron wizard and general mage
Source Mage GNU/Linux
http://www.sourcemage.org

Attachment: pgp0222aiQB2X.pgp
Description: PGP signature