Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: flux <flux AT sourcemage.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Sun, 18 Dec 2011 12:02:57 +0900

Sukneet Basuta (sukneet AT gmail.com) wrote [11.12.14 13:54]:
> I was thinking that spell maintainers could for now just set the hash
> of the signature to a set variable (for example SIG_HASH). It will be
> ignored by current versions of Sorcery, but will prepare the grimoire
> for the change, which will obviously take a while to do.
> I was also thinking that the signature hash should be optional in
> sorcery, at least upon introduction. That is, if SIG_HASH is missing,
> spells would still cast fine. This is advantageous to us since there
> are quite a few spells in the grimoire (with a decent amount
> unmaintained) so it'll take quite a while to update them all.

Ah, I thought you were actually calling for a more involved change such
that spells would fail without a version of sorcery including the
change.

> That's fine. I was merely trying to get things going. No one seconded
> my motions for a vote anyway and it been more than a week—unless David
> was seconding the motion by saying he was going to work on it.
> Maybe Bor's idea to first draft a new set of standards and then vote
> is the proper way to go about this.

Let's keep pushing. :) I think we should do the following, in order:

1) Call for a vote regarding putting SIG_HASH= in all spells that use
upstream signatures. If this passes, then we would update the policy
accordingly that spell writes MUST add SIG_HASH when adding an upstream
signature file to use for a spell.

2) If (1) passes, then call for a vote for how to implement it in
sorcery (make it an optional check, required check, etc.), by when, etc.

If this seems like a good idea, and nobody else makes the call, I'll
call for the vote.

--
Justin "flux_control" Boffemmyer
Cauldron wizard and general mage
Source Mage GNU/Linux
http://www.sourcemage.org

Attachment: pgpBUJYYdBBRB.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page